Skip to content

Enforce mandatory create-pull-request usage for /cloclo file changes#27370

Merged
pelikhan merged 2 commits intomainfrom
copilot/enforce-pr-creation-cloclo-workflow
Apr 20, 2026
Merged

Enforce mandatory create-pull-request usage for /cloclo file changes#27370
pelikhan merged 2 commits intomainfrom
copilot/enforce-pr-creation-cloclo-workflow

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 20, 2026 •
edited
Loading

/cloclo guidance allowed direct commits in practice because PR creation language was not strict enough. This updates the workflow prompt to make PR creation via safe outputs mandatory for any file modification and corrects a workflow directory typo.

  • Mandatory PR enforcement

    • Replaced soft wording in If Code Changes Are Needed with a hard constraint:
      • if any file is modified, create-pull-request must be called
      • direct commits to branches are explicitly disallowed

  • Critical Constraints hardening

    • Added a dedicated 🚨 MANDATORY block with explicit rules:
      • modified files require create-pull-request
      • never commit/push directly to any branch
      • no exceptions/alternatives
      • explicit failure condition if file changes occur without create-pull-request

  • Execution checklist alignment

    • Updated Begin Processing reminders to mirror the mandatory policy and direct-commit prohibition.

  • Path typo correction

    • Fixed .github/.workflows → .github/workflows in the protected directory constraint.
🚨 **MANDATORY**: If you changed ANY files, you MUST call the `create-pull-request` safe output to create a new PR.
This is non-negotiable — if you modified any files, a PR must be created.
Never commit directly to any branch.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name aw.test GOINSECURE GOMOD GOMODCACHE aw.test 2616�� se 1698522/b019/vet.cfg k GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env 3431055193 t2Bi/LbyKJAzlPTfrrG8ct2Bi .cfg GOINSECURE g/x/text/secure/init GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env 3431055193 ZDcH/WlCyhVRj9mWQyquJZDcH ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE l GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu/tmp/file-tracker-test1755817475/test2.lock.yml -###�� 21/001/test-simple-frontmatter.md FnMM/DTE1YZYN5-LgmGb0FnMM .cfg - GOWORK 64/bin/go ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env f3f5acc27b76e010-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv xterm-color 64/pkg/tool/linu-trimpath /usr/bin/infocmp 3603810255/.githgit om/modelcontextprev-parse 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linu-goversion /usr/bin/git 7454588/b233/_pk/opt/hostedtoolcache/node/24.14.1/x64/bin/npm GO111MODULE 64/pkg/tool/linu--package-lock-only git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse ache/go/1.25.8/x--show-toplevel git conf�� --get remote.origin.url /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git conf�� --get remote.origin.url ache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/vet ache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos=pub@{u} rev-parse /usr/bin/git ath ../../../.prgit GO111MODULE 64/bin/go git -C /tmp/gh-aw-test-runs/20260420-153106-58431/test-1141056537/custom/workflows rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xremote.origin.url /usr/bin/git se 1698522/b091/vetrev-parse .cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User /usr/bin/git 7454588/b210/impgit -trimpath ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel 1698522/b430/parser.test 86_64/node t0 -trimpath (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv t0 config .test m0s rk (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags ache/node/24.14.1/x64/bin/node -errorsas -ifaceassert -nilfunc ache/node/24.14.1/x64/bin/node 7577�� --show-toplevel -tests /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuother /usr/bin/git Onlymin-integritgit 1698522/b253/vetrev-parse ache/go/1.25.8/xHEAD git rev-�� tags/v3 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet sv /tmp/go-build257git -trimpath e/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git heck '**/*.cjs' git GO111MODULE .cfg git rev-�� --show-toplevel go /usr/bin/gh -json GO111MODULE ache/go/1.25.8/x--show-toplevel gh (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json ag.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD cpu/cpu.s x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD sm_wasm.s x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOMODCACHE 64/pkg/tool/linuremote.origin.url /usr/bin/git -json .cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuTest User /usr/bin/infocmp ned-imports-enabgit .cfg 64/pkg/tool/linu--show-toplevel infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle -json 90 x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE tions/setup/node--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git ortcfg .cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git ned-imports-enabgit GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv add remote2 /usr/bin/git -json 8 64/bin/go git rev-�� --show-toplevel go /usr/bin/git report.md GO111MODULE tions/setup/js/n--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --symref origin /usr/bin/gh go1.25.8 -c=4 -nolocalimports gh api runs/20260420-152539-33325/test-38855999 s/2/artifacts /tmp/go-build3261698522/b437/semverutil.test s/test.md ag.go x_amd64/compile /tmp/go-build3261698522/b437/semverutil.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /sh go /usr/bin/git -json GO111MODULE 64/bin/go git init�� --bare --initial-branch=develop /usr/bin/git -json GO111MODULE -d git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --count st/suppress-warnings.cjs $name) { hasDiscussionsEnabled } } README.md ion-test..token--c tions/setup/js/ngit config user.name 'Test User' st/dist/workers/forks.js show�� --verify cdce9883 tions/setup/node_modules/.bin/node token-test.txt (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv --count cdce9883..HEAD k/gh-aw/gh-aw/node_modules/.bin/git README.md ion-test..token-add _modules/.bin/gi. git show�� --verify cdce9883 git token-test.txt ings.cjs k/node_modules/.graphql git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv 05c13baf09275f5982ca66473249ae6aadc8d58b st/suppress-warnings.cjs $name) { hasDiscussionsEnabled } } user.name Test User git st/dist/workers/forks.js mpor�� HEAD 9a90493c 1/x64/bin/node --pack_header=2,git -q modules/@npmcli//home/REDACTED/work/gh-aw/gh-aw/.github/workflows k/gh-aw/gh-aw/acconfig (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv GOMODCACHE x_amd64/vet /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/lib/git-core/git dfWiE9R6S .cfg 64/pkg/tool/linu--show-toplevel /usr/lib/git-core/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ode git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv ons-test3501592305 x_amd64/asm /usr/bin/git l GO111MODULE x_amd64/compile git conf�� --get remote.origin.url /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv UpdateDiscussionFieldEnforcement3819087101/001 c /usr/bin/git l GO111MODULE 64/bin/go git add image:v1.0.0 go e/git -json GO111MODULE 64/bin/go e/git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv 1698522/b451/_pkg_.a x_amd64/compile 1698522/b451=> -json GO111MODULE x_amd64/compile git rev-�� s/test.md x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv if command -v wasm-opt >/dev/null 2>&1; then \ echo "Running wasm-opt -Oz (size--detach go /usr/lib/git-core/git -json GO111MODULE 64/bin/go /usr/lib/git-core/git main�� run (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name rg/x/text@v0.36.0/internal/language/common.go 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build3261698522/b115/vet.cfg ortc�� 2474305307/.github/workflows stmain.go .cfg GOINSECURE fips140/ecdh GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuconfig (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE sysrand ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/vet env 7454588/b169/_pkg_.a REzZ/UVSmm-gThuyfG0BeREzZ 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE e/git-upload-pack GOINSECURE GOMOD GOMODCACHE go faul�� -json GO111MODULE ache/node/24.14.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140deps/gode-unsafeptr=false GOMODCACHE 64/pkg/tool/linu/tmp/go-build3261698522/b112/vet.cfg env 2219755205 V4ci/NWzImF-917Hk3aRqV4ci 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 om/modelcontextprotocol/go-sdk@v1.5.0/internal/mcpgodebug/mcpgodebug.go 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 3431055193 GO111MODULE .cfg GOINSECURE contextprotocol/rev-parse 7454588/b092/sym--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 0002220/b437=> GOINSECURE GOMOD GOMODCACHE go env -Yd6/B_iJdTrtDz9DR-2--Yd6 GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE 1/x64/bin/node (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linu-test.short=true GOINSECURE 7454588/b092/ GOMODCACHE 64/pkg/tool/linux_amd64/vet env 3431055193 GO111MODULE .cfg GOINSECURE contextprotocol//tmp/js-hash-test-144099430/test-hash.js 7454588/b092/sym/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE ache/node/24.14.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go t-17�� sistency_GoAndJavaScript3347162443/001/test-empty-frontmatter.md GO111MODULE /home/REDACTED/.config/composer/vendor/bin/sh GOINSECURE GOMOD GOMODCACHE 0002220/b442/importcfg (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name rg/x/text@v0.36.0/internal/tag/tag.go 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/aes GOMODCACHE 64/pkg/tool/linux_amd64/vet env 7454588/b241/_pkg_.a qrnP/bIu9B-2Kyy25-yTJqrnP .cfg GOINSECURE t/internal/langu/tmp/js-hash-test-4024505846/test-hash.js GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/bigmod 7454588/b021/sym--git-dir 64/pkg/tool/linux_amd64/vet env 7454588/b246/_pkg_.a c9ZF/KtTFKQuDD_Pbt7zDc9ZF 64/pkg/tool/linux_amd64/vet GOINSECURE t/message/catalorev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -c if ! cd actions/setup/js && npm run check:pkg-json 2>&1 | grep -q "All matched files use Prettiegit GOPROXY /home/REDACTED/work/gh-aw/node_modules/.bin/sh GOSUMDB GOWORK 64/bin/go sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name dE5S/nPvk3w7LQzW_3ywvdE5S 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2474305307 taK6/ikh7gQ1RReQdq87ptaK6 k GOINSECURE fips140/ecdsa GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE g/x/net/dns/dnsmconfig 7454588/b015/symuser.name pBvTgXO/G1KutSxXTest User env 7454588/b244/_pkg_.a jfLv/0caWgwAWMGdke8fejfLv ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/numberev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linushow (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE /home/REDACTED/work/_temp/uv-python-dir/node GOINSECURE GOMOD GOMODCACHE node /opt�� faultBranchFromLsRemoteWithRealGitbranch_with_hyphen2978597451/0remote.origin.url faultBranchFromLsRemoteWithRealGitbranch_with_hyphen2978597451/002/work .cfg GOSUMDB GOWORK run-script/lib/n--show-toplevel sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE l/buffer GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2474305307/.github/workflows pRaw/gwkwek_UF5vdtNyzpRaw ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE entropy ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/vet env 7454588/b248/_pkg_.a h5RJ/fhSiz4P0ozPJ9_2Hh5RJ ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/formarev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE /bin/sh GOINSECURE GOMOD GOMODCACHE /bin/sh -c cd actions/setup/js && npm run lint:cjs =my-default /home/REDACTED/work/node_modules/.bin/sh GOSUMDB GOWORK 64/bin/go cho "��� Warning: .github/aw/actions-lock.json dremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name vce9/Iw7fHw9tzQV_56Gjvce9 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 2474305307/.github/workflows 3zY_/HcUWNrRjpCKdAR9m3zY_ .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linushow (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 rg/x/text@v0.36.0/internal/number/common.go 64/pkg/tool/linux_amd64/vet GOINSECURE light 7454588/b021/symuser.email 64/pkg/tool/linutest@example.com env 7454588/b247/_pkg_.a 28ie/dWadUuI3oiBsYAOo28ie .cfg GOINSECURE t/internal GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE e/git-upload-pack GOINSECURE GOMOD s,MFiles,HFiles,--show-toplevel node faul�� run lint:cjs /opt/hostedtoolcache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/n--show-toplevel GOSUMDB GOWORK 64/bin/go sh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path 158405054/001' 158405054/001' -importcfg /tmp/go-build3261698522/b418/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json gset/set.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 7454588/b193/_pkg_.a .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build3261698522/b403/cli.test /tmp/go-build3261698522/b403/cli.test -test.testlogfile=/tmp/go-build3261698522/b403/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /tmp/go-build1615766608/b403/cli.test /tmp/go-build1615766608/b403/cli.test -test.testlogfile=/tmp/go-build1615766608/b403/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuTest User /usr/bin/git 21/001/test-inligit 1698522/b151/vetrev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git ExpressionCompills 1698522/b219/vet-lh ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE k/gh-aw/gh-aw/ac--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 3106-58431/test-ls GO111MODULE 1/x64/bin/node git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 7454588/b059/importcfg .cfg Name,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xremote.origin.url estl�� se 1698522/b097/vet.cfg x_amd64/vet -p internal/race -lang=go1.25 x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go ode_�� ay_c2076024593/001 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go -Oz --enable-bunode GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json at.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE SLlQ1ZG/V_z3kiodrev-parse (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet 8405�� -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE jsonrpc2 GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 180092077/001 180092077/002/work 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv fq9m/dOvw0liy9-ZbDdQ2fq9m .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env rity3305684555/001 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE /go-yaml/scannerrev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1698522/b474/_pkg_.a GO111MODULE x_amd64/compile GOINSECURE b/gh-aw/tmp GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*.js' --ignore-path .prettierignore sh /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo npx prettier --wgh x_amd64/compile 64/bin/go /opt/hostedtoolcrepos/{owner}/{repo}/actions/runs/5/artifacts (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD cpu/cpu.s x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json age.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state 64/pkg/tool/linux_amd64/link GOINSECURE g/x/text/transforev-parse GOMODCACHE 64/pkg/tool/linux_amd64/link conf�� eutil.test _isA/iz-VlEV3Z-CBIoY6_isA ortcfg.link GOSUMDB GOWORK 64/bin/go 1tjYVSqOEP82kiP9^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name 58405054/001' 58405054/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE modules/@npmcli/run-script/lib/node-gyp-bin/sh GOINSECURE GOMOD GOMODCACHE go env h ../../../.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 7454588/b247/_pkg_.a 28ie/dWadUuI3oiBsYAOo28ie .cfg GOINSECURE t/internal GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu--jq (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch --get remote.origin.url /usr/bin/git json' --ignore-pgit GO111MODULE 64/bin/go git conf�� --get remote.origin.url /usr/bin/git th .prettierignogit GO111MODULE x_amd64/vet git (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git form�� origin/auth-cleanup-success..auth-cleanup-success --stdout ode_modules/.bin/git -1 --format=%s e/git git add . e/git tions/setup/node_modules/.bin/git 3 Initial commit ache/node/24.14.agent-change.txt git (dns block)
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git rev-�� --count origin/auth-cleanup-success..auth-cleanup-success ode_modules/.bin/git /tmp/git-patch-o/usr/lib/git-core/git git es/.bin/git git conf�� user.email lure test commit tions/setup/node_modules/.bin/git . git -branch git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI linked an issue Apr 20, 2026 that may be closed by this pull request
[q] Enforce mandatory PR creation for file changes in cloclo workflow #27369
Closed
Copilot AI changed the title [WIP] Enforce mandatory PR creation for file changes in cloclo workflow Enforce mandatory create-pull-request usage for /cloclo file changes Apr 20, 2026
Copilot AI requested a review from pelikhan April 20, 2026 15:40
@pelikhan pelikhan marked this pull request as ready for review April 20, 2026 15:46
Copilot AI review requested due to automatic review settings April 20, 2026 15:46
@pelikhan pelikhan merged commit d1dbe9e into main Apr 20, 2026
@pelikhan pelikhan deleted the copilot/enforce-pr-creation-cloclo-workflow branch April 20, 2026 15:46
Copilot AI reviewed Apr 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Tightens the /cloclo workflow instructions to require PR creation via the create-pull-request safe output for any file modifications, and fixes a typo in the protected workflows directory path.

Changes:

  • Replaced permissive “always create a PR” phrasing with explicit, non-negotiable rules requiring create-pull-request whenever any file is modified.
  • Added a dedicated “🚨 MANDATORY” block that explicitly forbids direct commits/pushes to branches and defines failure conditions.
  • Corrected the protected workflows directory path from .github/.workflows to .github/workflows.
Show a summary per file
File Description
.github/workflows/cloclo.md Hardens /cloclo execution constraints to enforce PR-based changes and corrects the protected directory path typo.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 0

@github-actions github-actions bot mentioned this pull request Apr 20, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@pelikhan pelikhan Awaiting requested review from pelikhan

Assignees

@pelikhan pelikhan

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[q] Enforce mandatory PR creation for file changes in cloclo workflow

3 participants

@pelikhan