Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3d92959f-f325-4be8-8abf-38342e590710 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3d92959f-f325-4be8-8abf-38342e590710 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Reduces Copilot Token Usage Optimizer overhead by narrowing tool loading, shifting routine data aggregation into deterministic pre-steps, and compacting the optimizer prompt while directing workflow-source reads through gh via the CLI proxy.
Changes:
- Narrow GitHub toolset configuration and switch from GitHub MCP file reads to a CLI-proxy-based
ghpath. - Add pre-aggregation steps to materialize top token-consuming workflows and print optimization history.
- Rewrite/compact the optimizer prompt into a smaller, phase-oriented instruction set.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/copilot-token-optimizer.md | Updates tool/features config, adds jq pre-aggregation + optimization history steps, and compacts the optimizer prompt with cli-proxy guidance. |
| .github/workflows/copilot-token-optimizer.lock.yml | Regenerates compiled workflow to include cli-proxy wiring, COPILOT_GITHUB_TOKEN validation, and the new pre-aggregation/history steps. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/copilot-token-optimizer.lock.yml:682
- The MCP gateway config no longer includes a
githubserver, but the workflow still runs steps specific to the “GitHub MCP Server” (e.g., determining lockdown mode) earlier in the job. If GitHub MCP is intentionally removed in favor of cli-proxy, those GitHub-MCP-specific steps/inputs should also be removed to avoid dead work and keep the compiled workflow consistent with the new tool path.
cat << GH_AW_MCP_CONFIG_8074596f7a306dc7_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
{
"mcpServers": {
"safeoutputs": {
"type": "http",
"url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
"headers": {
- Files reviewed: 2/2 changed files
- Comments generated: 1
| - name: Download container images | ||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.24 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.24 ghcr.io/github/gh-aw-firewall/squid:0.25.24 ghcr.io/github/gh-aw-mcpg:v0.2.24 ghcr.io/github/github-mcp-server:v1.0.0 node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b | ||
| run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.24 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.24 ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.24 ghcr.io/github/gh-aw-firewall/squid:0.25.24 ghcr.io/github/gh-aw-mcpg:v0.2.24 ghcr.io/github/github-mcp-server:v1.0.0 node:lts-alpine@sha256:01743339035a5c3c11a373cd7c83aeab6ed1457b55da6a69e014a95ac4e4700b |
There was a problem hiding this comment.
download_docker_images.sh still pulls ghcr.io/github/github-mcp-server:v1.0.0, but the MCP gateway config no longer defines a github server (only safeoutputs). This adds unnecessary network/time overhead; remove the GitHub MCP server image from the download list (and upstream manifest inputs) if GitHub MCP is intentionally disabled for this workflow.
This issue also appears on line 676 of the same file.
This comment has been minimized.
This comment has been minimized.
|
Great work on this optimization pass for the Copilot Token Usage Optimizer! 🎉 Narrowing the toolset to The one gap here is test/validation coverage. No test files were changed alongside these workflow modifications. Some form of validation would strengthen confidence in the changes — for example:
If you'd like a hand adding validation, here's a prompt for your coding agent:
|
The Copilot Token Usage Optimizer was consuming disproportionate tokens due to broad MCP tool loading, verbose repeated prompt content, and agent-side data discovery work. This update narrows runtime surface area and shifts routine aggregation into deterministic pre-steps.
Workflow runtime footprint
toolsets: [default]totoolsets: [issues].mount-as-clisandcopilot-requestsfrom workflow config.cli-proxyand removedshared/mcp/gh-aw.mdimport to avoid unnecessary MCP/container setup for file reads.Pre-computed analysis inputs
/tmp/gh-aw/token-audit/top-workflows.json/tmp/gh-aw/repo-memory/default/optimization-log.jsonPrompt compaction and execution guidance
ghcommands via cli-proxy.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet GOINSECURE /go-yaml/internarev-parse 0949076/b087/sym--show-toplevel 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh repo view owner/repo env 541389247 O_e3/jNiaaPEe3F5AUUx1O_e3 64/pkg/tool/linux_amd64/compile GOINSECURE g/x/crypto/chach/tmp/js-hash-test-2779259047/test-hash.js GOMODCACHE 64/pkg/tool/linux_amd64/compile buil�� 85/001/test-frontmatter-with-arrays.md TWRl/eDvIxLANZ0cGFI5vTWRl cfg gh-aw ./cmd/gh-aw 64/bin/go ache/go/1.25.8/x^remote\..*\.gh-resolved$(http block)/usr/bin/gh gh repo view owner/repo env 0949076/b210/_pkg_.a 3cxW/IBlaqeSprCJhOYFQ3cxW 64/pkg/tool/linux_amd64/link GOINSECURE g/x/crypto/interrev-parse GOMODCACHE 64/pkg/tool/linux_amd64/link -c til.test oXnN/-5aZqfwMX4HRR0X2oXnN rtcfg.link --format=%H:%ct GOWORK 64/bin/go fEmuZxTCue0RDK6B^remote\..*\.gh-resolved$(http block)https://api.github.com/orgs/test-owner/actions/secrets/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json age/common.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -template-expressions.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 8c46274245fca23c-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 3ee6a87ccabf9119-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv list --json /usr/bin/gh --workflow nonexistent-workrev-parse --limit gh --ve�� GOMODCACHE 64/pkg/tool/linux_amd64/vet /usr/bin/git ithub/workflows GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel resolved$ /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git epOnly,Imports,Igit GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 9Zabsz6/SzeH-G-Lconfig /usr/bin/git -json GO111MODULE d0aa800f72dbf753--show-toplevel git rev-�� ; printf '%s' "$2" 1>&2 go st.md","valid":true,"errors":[],"warnings":[]}] should not be rgit GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv xterm-color x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet ache/node/24.14.1/x64/bin/node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/infocmp h ../../../.pretgit GO111MODULE 64/bin/go infocmp -1 xterm-color go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.1/x64/bin/node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyBlockedUsersExpressionCompiledOutput985888577/001 config /usr/bin/git remote.origin.urgit GO111MODULE 64/bin/go git rev-�� --show-toplevel go(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv gEL23Jatl 996932/b098/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p iter -lang=go1.25 hz/8-8vmLiYCmHH9yLNKNaz/ITCHFh6R_3VA1bELNvSY -o 3412550892 g/envutil/envutil_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -p ebug.go -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git _.a 996932/b032/vet.rev-parse x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git DefaultBranchFrogit DefaultBranchFrorev-parse ache/go/1.25.8/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet n-dir/node -bool -buildtags /opt/hostedtoolc--show-toplevel git 1/x6�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build437git -trimpath om/testorg/testr--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git /tmp/go-build215git pkg/mod/golang.orev-parse ache/go/1.25.8/xHEAD git rev-�� --show-toplevel ache/go/1.25.8/x-buildtags /usr/bin/git 4926-38157/test-git -trimpath xpires.lock.yml git(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv download 3 /usr/bin/git test-logs/run-3 GO111MODULE cfg git rev-�� --show-toplevel go /usr/bin/git ApprovalLabelsCogit GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD cpu/cpu.s x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git l 2>&1; then \ git GO111MODULE 64/pkg/tool/linu--show-toplevel git conf�� --get remote.origin.url /usr/bin/infocmp -json om/segmentio/asmrev-parse 64/pkg/tool/linu--show-toplevel infocmp(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git init�� GOMODCACHE x_amd64/vet /usr/bin/git -json GO111MODULE 1/x64/bin/npx git(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git Ooj2bVjat GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuconfig /usr/bin/gh 0949076/b041/_pkgit cfg 64/pkg/tool/linu--show-toplevel gh(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git init�� GOMODCACHE x_amd64/vet /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv v1.0.0 -tests 996932/b439/vet.cfg -json 0 x_amd64/compile git -C /tmp/TestGuardPolicyTrustedUsersExpressionCompiledOutput3140531968/001(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -aw/git/ref/tags/v1.2.3 -buildtags bject.type] | @tsv -errorsas -ifaceassert -nilfunc /usr/bin/git conf�� ons-test3639918694 ^remote\..*\.gh-resolved$ ow-with-reaction.lock.yml -json GO111MODULE 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows/api-consumption-report.md -test.v=true /usr/bin/gh -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel gh work�� ithub-script/git/ref/tags/v9 --json bject.type] | @tsv --repo owner/repo 64/bin/go git(http block)https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv er.test st/suppress-warnings.cjs node token-test2.txt patch modules/@npmcli/--noprofile st/dist/workers/forks.js --ex�� --require 3b5869ba128f1c18453d41c2 3902fc37e9fc4e3204a0e8eb0adc705422835d0e433e9d5f0537fa252a97a3eb-d node --conditions run-script/lib/n/home/REDACTED/work/gh-aw/gh-aw/.github/workflows node(http block)/usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --verify tions/setup/js/node_modules/vite--conditions 86_64/git -m patch de_modules/.bin/--noprofile tions/setup/js/node_modules/vitest/dist/workers/forks.js /hom�� _modules/.bin/gia3251e94dce9bbcb76a2aee8c4cdd2fefc811912 3b5869ba128f1c18453d41c2 ode_modules/.bin/go origin/token-opt/usr/bin/gh git modules/@npmcli/graphql /opt/hostedtoolc-f(http block)Agent-Logs-U-U0 n-dir/git origin/token-optgzip git tions/setup/js/n-9 ode_modules/vite.//alternatives.tar.0 --ex�� --require b3ca020e541a94f8b96ebb88 bin/git node --conditions development ache/node/24.14.config` (http block)