fix: activate GitHub App configuration in shared workflow configs by Copilot · Pull Request #21329 · github/gh-aw

Copilot · 2026-03-17T03:18:04Z

Several shared workflow configs had GitHub App configuration either commented out or using the wrong field name, causing workflows that import them to silently skip GitHub App authentication.

Changes

shared/safe-output-app.md — uncomment safe-outputs.github-app block (using the correct field name that the Go parser expects):
```
safe-outputs:
  github-app:
    app-id: ${{ vars.APP_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
```
shared/app-config.md — rename safe-outputs.app → safe-outputs.github-app to match the Go parser's expected field name (outputMap["github-app"] in safe_outputs_config.go).
shared/activation-app.md — uncomment on.github-app: block to activate GitHub App authentication for the activation job in all 11 importing workflows (code-simplifier, dead-code-remover, ubuntu-image-analyzer, daily-testify-uber-super-expert, breaking-change-checker, daily-rendering-scripts-verifier, code-scanning-fixer, issue-monster, slide-deck-maintainer, daily-file-diet, daily-safe-output-optimizer).
pkg/workflow/compiler_safe_outputs_job.go — fix off-by-one bug in the app token step insertion index: replace hardcoded step counts (6 for checkout, 4 for setup) with actual len() calls against the real step-generation functions. The hardcoded 6 was wrong for dev mode, which generates 7 lines (includes repository:), causing the echo "GH_AW_AGENT_OUTPUT=..." line to be embedded inside the with: block of create-github-app-token instead of in its own step.
16 lock files — now include Generate GitHub App token and Invalidate GitHub App token steps (or Generate GitHub App token for skip-if checks) with correct YAML structure.
testdata/wasm_golden/fixtures/shared/safe-output-app.md — added fixture mirror with config kept commented out, consistent with the github-mcp-app.md fixture convention.

Original prompt

Review GitHub-app configuration for dependencies and fix

See safe-output-app.md for env vars and

See error at https://github.com/github/gh-aw/actions/runs/23175963022/job/67338791074

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-03-17T03:45:02Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-03-17T03:45:07Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-03-17T03:45:14Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-03-17T03:45:24Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

pelikhan · 2026-03-17T03:47:42Z

.github/workflows/shared/safe-output-app.md

-#    app-id: ${{ vars.APP_ID }}
-#    private-key: ${{ secrets.APP_PRIVATE_KEY }}
+safe-outputs:
+  app:


@copilot fix app to github-app

Fixed in 144aa46 — renamed app: to github-app: to match the field name the Go parser expects (outputMap["github-app"] in safe_outputs_config.go). Also fixed a pre-existing off-by-one in the token insertion index that was exposed once the app config became active (hardcoded 6 for checkout step vs actual 7 lines in dev mode).

github-actions · 2026-03-17T03:54:43Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

… consolidated safe outputs job Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-17T04:07:54Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw QM54CA-R2u1ieV95--norc on_test.go est.go (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw n_pins.go n_pins_integratixterm-color n_pins_logging_test.go n_pi�� n_reference.go n_reference_test.go (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -dirty" -o gh-aw ./cmd/gh-aw (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility ithub/workflows user.email er: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabl/home/REDACTED/work/gh-aw/gh-aw/.github/workflows (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility xterm-color (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha k/gh-aw/gh-aw/.github/workflows (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-03-17T04:13:00Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-03-17T04:13:01Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-03-17T04:13:07Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2026-03-17T04:13:14Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

pelikhan · 2026-03-17T04:17:09Z

@copilot import safe-output-map.md in the changeset.md agentic workflow

github-actions · 2026-03-17T04:21:52Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copilot · 2026-03-17T04:28:19Z

@copilot import safe-output-map.md in the changeset.md agentic workflow

safe-output-map.md doesn't exist in the shared/ directory. Could you clarify what it should contain? Note that changeset.md already imports safe-output-app.md (which provides the safe-outputs.github-app GitHub App credentials). If you meant a different file or want a new shared config created, please share the intended content.

Copilot

Pull request overview

Enables GitHub App authentication for safe-outputs by activating the shared app configuration and fixing step insertion so the minted token is injected at the correct position in generated workflows.

Changes:

Uncomment/activate safe-outputs.github-app configuration in the shared safe-output-app.md.
Fix safe-outputs job compilation logic to compute the GitHub App token step insertion index from actual generated step YAML lengths.
Regenerate affected workflow lock files to include “Generate GitHub App token” / “Invalidate GitHub App token” steps; add a wasm golden fixture mirror for the shared config.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`.github/workflows/shared/safe-output-app.md`	Activates the `safe-outputs.github-app` config so workflows actually mint an app token for safe-outputs.
`pkg/workflow/compiler_safe_outputs_job.go`	Adjusts insertion-index calculation to use real generated step lengths (instead of hardcoded counts).
`.github/workflows/artifacts-summary.lock.yml`	Regenerated lock file now uses the minted app token for safe-outputs steps and revokes it afterward.
`.github/workflows/changeset.lock.yml`	Regenerated lock file now uses the minted app token for safe-outputs steps and revokes it afterward.
`.github/workflows/daily-file-diet.lock.yml`	Regenerated lock file now uses the minted app token for safe-outputs steps and revokes it afterward.
`.github/workflows/daily-mcp-concurrency-analysis.lock.yml`	Regenerated lock file now uses the minted app token for safe-outputs steps and revokes it afterward.
`.github/workflows/daily-testify-uber-super-expert.lock.yml`	Regenerated lock file now uses the minted app token for safe-outputs steps and revokes it afterward.
`pkg/workflow/testdata/wasm_golden/fixtures/shared/safe-output-app.md`	Adds a wasm golden fixture mirror of the shared safe-output app configuration (kept commented).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

pkg/workflow/compiler_safe_outputs_job.go

@@ -266,10 +266,8 @@ func (c *Compiler) buildConsolidatedSafeOutputsJob(data *WorkflowData, mainJobNa
 		// Count setup action steps (checkout + setup if in dev mode without action-tag, or just setup)
 		setupActionRef := c.resolveActionReference("./actions/setup", data)
 		if setupActionRef != "" {


pkg/workflow/testdata/wasm_golden/fixtures/shared/safe-output-app.md

@@ -0,0 +1,31 @@
+---
+#safe-outputs:
+#  app:


pelikhan · 2026-03-17T04:39:20Z

@copilot update app-config.md and activation-app.md to use the github-app field instead of app

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-17T04:43:47Z

@copilot update app-config.md and activation-app.md to use the github-app field instead of app

Done in 04c5583 — app-config.md now uses safe-outputs.github-app: to match the Go parser's expected field name. activation-app.md already used on.github-app: so no change was needed there.

pelikhan · 2026-03-17T04:49:58Z

@copilot rewrite

…ted lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-17T04:55:15Z

@copilot rewrite

Done in 6eb3e2b — uncommented the on.github-app: block in activation-app.md and recompiled the 11 affected lock files to include the Generate GitHub App token for skip-if checks step.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw mRJ5vOs8-PiP (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-03-17T04:58:13Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-03-17T04:58:14Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-03-17T04:58:22Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2026-03-17T04:58:25Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-03-17T05:01:50Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.53.0
jq	✅	1.7
yq	✅	4.52.4
curl	✅	8.5.0
gh	✅	2.87.3
node	✅	20.20.1
python3	✅	3.12.3
go	✅	1.24.13
java	✅	10.0.102
dotnet	✅	10.0.102

Result: 12/12 tools available ✅

Overall Status: PASS

🔧 Tool validation by Agent Container Smoke Test · ◷

github-actions · 2026-03-17T05:07:43Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Initial plan

3fc8735

Copilot AI assigned Copilot and pelikhan Mar 17, 2026

Copilot started work on behalf of pelikhan March 17, 2026 03:18 View session

fix: uncomment GitHub App configuration in safe-output-app.md

e002d26

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix GitHub-app configuration for dependencies~~ fix: activate GitHub App configuration in safe-output-app.md Mar 17, 2026

Copilot AI requested a review from pelikhan March 17, 2026 03:42

Copilot finished work on behalf of pelikhan March 17, 2026 03:42

pelikhan added the smoke label Mar 17, 2026

github-actions bot removed the smoke label Mar 17, 2026

pelikhan reviewed Mar 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan March 17, 2026 03:47 View session

This comment has been minimized.

Sign in to view

fix: rename safe-outputs.app to github-app and fix insertion index in…

144aa46

… consolidated safe outputs job Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan March 17, 2026 04:08

Copilot finished work on behalf of pelikhan March 17, 2026 04:08

pelikhan added the smoke label Mar 17, 2026

github-actions bot removed the smoke label Mar 17, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of pelikhan March 17, 2026 04:17 View session

Copilot finished work on behalf of pelikhan March 17, 2026 04:28

pelikhan marked this pull request as ready for review March 17, 2026 04:31

Copilot AI review requested due to automatic review settings March 17, 2026 04:31

Copilot started reviewing on behalf of pelikhan March 17, 2026 04:32 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

Copilot started work on behalf of pelikhan March 17, 2026 04:39 View session

fix: rename safe-outputs.app to safe-outputs.github-app in app-config.md

04c5583

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~fix: activate GitHub App configuration in safe-output-app.md~~ fix: activate GitHub App configuration in safe-output-app.md and related shared configs Mar 17, 2026

Copilot finished work on behalf of pelikhan March 17, 2026 04:44

Copilot started work on behalf of pelikhan March 17, 2026 04:50 View session

fix: uncomment on.github-app in activation-app.md and recompile affec…

6eb3e2b

…ted lock files Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~fix: activate GitHub App configuration in safe-output-app.md and related shared configs~~ fix: activate GitHub App configuration in shared workflow configs Mar 17, 2026

Copilot finished work on behalf of pelikhan March 17, 2026 04:56

pelikhan added the smoke label Mar 17, 2026

github-actions bot removed the smoke label Mar 17, 2026

pelikhan merged commit 5ef1312 into main Mar 17, 2026
200 of 203 checks passed

pelikhan deleted the copilot/fix-github-app-configuration branch March 17, 2026 05:12

Conversation

Copilot AI commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

pelikhan Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

This comment has been minimized.

pelikhan commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

pelikhan commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

pelikhan commented Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 17, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Copilot AI commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

Copilot AI commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading