Repository navigation
[detection-analysis] Detection Analysis Report — 2026-11-01 #73906
Closed
Replies: 1 comment
|
This discussion has been marked as outdated by Detection Analysis Report. A newer discussion is available at Discussion #74254. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Summary
2026-10-31T23:20:00Zto2026-11-01T23:20:00Zgh-aw-detection: false): 88 (13.6%)Note
No misconfigured
gh-aw-detectionworkflows were found in this window. Detection ran cleanly across all 618 runs that included adetectionjob (613 success, 5 skipped, 0 failures), and no workflow alternated between enabled/disabled modes.Comparison Chart
Misconfigured Workflows
No misconfigured workflows detected in this window.
All three detection rules were checked against the 645 analyzed runs:
gh-aw-detection: falseon a high-frequency workflow — the 56 workflows running with detection disabled are all low-frequency "Smoke *"/conformance test workflows (≤3 runs each in this 24h window). None crossed the literal >3-run threshold within the window itself; 7-day run counts weren't directly queryable from this 24h log pull, so this check is a conservative proxy (see Recommendations).detectionjob showed a failing job conclusion (613 success, 5 skipped).View All Run Metrics
Workflows with 2+ runs in the window (39 of 202 total; the remaining 163 workflows each had exactly 1 run):
Coverage note: 191 downloaded run directories lacked
aw_info.json(non-executed, cancelled, or metadata-only runs) and were excluded from classification; this does not affect the detection-vs-regular comparison since those runs never reached a classifiable job state.View Historical Trend
Trend covers 2026-10-03 to 2026-11-01 (22 of those 30 days have data points; 33 distinct days of history exist overall going back to 2026-08-25).
Recommendations
>3 runs/7 dayswith detection disabled) could only be approximated from this 24h log pull — a dedicated 7-day query would give a higher-confidence answer for the ~56 workflows currently opting out, in case any of them run more often than their 24h sample suggests.PR Sous Cheffailed in 122 of 123 runs this window, but job-level attribution shows both itsagentanddetectionjobs succeeded every time — the failures trace to itssafe_outputsjob (e.g. §41252204558). Worth a separate look outside this detection-focused report.References:
PR Sous Chefrun (safe_outputs job failure, detection/agent jobs succeeded)All reactions