Add command position validation for command triggers to prevent accidental execution by Copilot · Pull Request #2031 · github/gh-aw

Copilot · 2025-10-20T15:51:38Z

Problem Summary

The command trigger should require the command to be the first word of the comment/body. Currently, the system uses contains() to check if the command appears anywhere in the text.

Implementation Plan

Add a pre-activation step to validate command is first word in text
- Modified buildPreActivationJob to add command validation step when command trigger is present
- Created check_command_position.cjs JavaScript script to check command position
- Updated activation condition to include command position check
During safe output collection, prevent generated text from starting with command words
- Modified sanitize_output.cjs to check for and neutralize command words at start of text
- Pass GITHUB_AW_COMMAND to safe output sanitization step
Update documentation
- Updated command-triggers.md to document first-word requirement with Astro caution adornment
- Removed redundant section
- Updated agentic-authoring instructions
Address PR feedback
- Use Astro Starlight caution adornment for better documentation
- Remove redundant "Command Position Requirement" section
- Optimize logic to pass check when text doesn't contain command
Tests and formatting
- All tests passing (10 tests for command position)
- JavaScript formatting validated

Implementation Details

Pre-Activation Validation

New JavaScript Script: check_command_position.cjs
- Validates command is the first word in triggering text
- Optimized to pass check when text is empty or doesn't contain command at all
- Handles all event types (issues, comments, PRs, discussions)
- Sets command_position_ok output for activation condition
Compiler Changes:
- Added CheckCommandPositionStepID and CommandPositionOkOutput constants
- Modified buildPreActivationJob to add command position check step
- Updated pre-activation job creation condition to include command triggers
- Added command position check to activation conditions

Safe Output Protection

Sanitization Enhancement: sanitize_output.cjs
- Added neutralizeCommandAtStart() function
- Checks if text starts with command pattern
- Wraps command in backticks to prevent re-trigger
- Integrates with existing sanitization pipeline
Environment Variable Pass-through:
- Modified compiler to pass GITHUB_AW_COMMAND to ingest step
- Ensures command name is available for sanitization

Testing

Added comprehensive test suite for check_command_position.cjs (10 tests)
Added tests for command neutralization in sanitize_output.test.cjs (6 tests)
All existing tests pass
JavaScript formatting validated

Verification

Compiled poem-bot.md and verified:

✅ Pre-activation job includes command position check step with optimized logic
✅ Activation condition includes command_position_ok check
✅ GITHUB_AW_COMMAND passed to ingest agent output step
✅ All tests passing
✅ Linting passing

Key Files Modified

pkg/workflow/js/check_command_position.cjs - Validation script with optimized logic
pkg/workflow/js/check_command_position.test.cjs - Tests (10 tests)
pkg/workflow/js/sanitize_output.cjs - Command neutralization
pkg/workflow/js/sanitize_output.test.cjs - Tests (6 new tests)
pkg/workflow/compiler.go - Pre-activation job and env vars
pkg/workflow/js.go - Embed new script
pkg/constants/constants.go - New constants for step IDs
docs/src/content/docs/reference/command-triggers.md - Documentation with Astro adornments
.github/instructions/github-agentic-workflows.instructions.md - Instructions

Original prompt

The command trigger should require the command to be the first word of the comment.

add a step in the pre-activation job that validate that the command if the first word, if the text contains the command. Update the activated expression to reflect this check

during the collection and validation of safe outputs, ensure that the generated text does not start with any command word to prevent cycles.

update docs

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

- Add check_command_position.cjs script to validate command is first word - Update compiler to add command position check step to pre-activation job - Update activation condition to include command position check - Add command neutralization in sanitize_output.cjs to prevent cycles - Pass GITHUB_AW_COMMAND to safe output steps - Add comprehensive tests for command position validation - Update documentation to explain first-word requirement Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-10-20T16:22:26Z


 This automatically creates issue/PR triggers (`opened`, `edited`, `reopened`), comment triggers (`created`, `edited`), and conditional execution matching `/command-name` mentions.

+**Important**: The command must be the **first word** of the comment or body text to trigger the workflow. This prevents accidental triggers when the command is mentioned elsewhere in the content.


@copilot use Astro starlight adornments

Changed to use Astro Starlight caution adornment in commit a0b2d5c.

pelikhan · 2025-10-20T16:22:45Z


 **Note**: You cannot combine `command` with `issues`, `issue_comment`, or `pull_request` as they would conflict.

+## Command Position Requirement


@copilot remove section

Removed redundant "Command Position Requirement" section in commit a0b2d5c.

pelikhan · 2025-10-20T16:25:50Z

+      return;
+    }
+
+    if (!text) {


@copilot if !text or not text contains command

Optimized logic to pass check when text is empty or doesn't contain the command. Updated tests accordingly in commit a0b2d5c.

…optimize logic - Use Astro caution adornment for command position requirement - Remove redundant "Command Position Requirement" section - Optimize check_command_position.cjs to pass check when text is empty or doesn't contain command - Add test for text without command - Update test assertions to match new log messages Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2025-10-20T16:39:17Z

Agentic Changeset Generator triggered by this pull request.

Initial plan

7492b20

Copilot AI assigned Copilot and pelikhan Oct 20, 2025

Copilot started work on behalf of pelikhan October 20, 2025 15:51 View session

Copilot AI and others added 2 commits October 20, 2025 16:14

Fix JavaScript formatting

02217c7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add command validation in pre-activation job~~ Add command position validation for command triggers to prevent accidental execution Oct 20, 2025

Copilot AI requested a review from pelikhan October 20, 2025 16:23

Copilot finished work on behalf of pelikhan October 20, 2025 16:23

pelikhan reviewed Oct 20, 2025

View reviewed changes

Copilot started work on behalf of pelikhan October 20, 2025 16:27 View session

Copilot finished work on behalf of pelikhan October 20, 2025 16:36

Copilot AI requested a review from pelikhan October 20, 2025 16:36

pelikhan marked this pull request as ready for review October 20, 2025 16:39

pelikhan approved these changes Oct 20, 2025

View reviewed changes

Add changeset for command position validation

bea7279

pelikhan merged commit 5ca872d into main Oct 20, 2025
4 checks passed

pelikhan deleted the copilot/update-command-validation-checks branch October 20, 2025 16:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add command position validation for command triggers to prevent accidental execution#2031

Add command position validation for command triggers to prevent accidental execution#2031
pelikhan merged 5 commits intomainfrom
copilot/update-command-validation-checks

Copilot AI commented Oct 20, 2025 •

edited

Loading

Uh oh!

pelikhan Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

pelikhan Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

pelikhan Oct 20, 2025

Uh oh!

Copilot AI Oct 20, 2025

Uh oh!

github-actions Bot commented Oct 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		This automatically creates issue/PR triggers (`opened`, `edited`, `reopened`), comment triggers (`created`, `edited`), and conditional execution matching `/command-name` mentions.

		Important: The command must be the first word of the comment or body text to trigger the workflow. This prevents accidental triggers when the command is mentioned elsewhere in the content.


		Note: You cannot combine `command` with `issues`, `issue_comment`, or `pull_request` as they would conflict.

		## Command Position Requirement

Conversation

Copilot AI commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Summary

Implementation Plan

Implementation Details

Pre-Activation Validation

Safe Output Protection

Testing

Verification

Key Files Modified

Uh oh!

pelikhan Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Oct 20, 2025 •

edited

Loading