Skip to content

Guard list_code_scanning_alerts workflow usage to prevent MCP context overflow#27657

Merged
pelikhan merged 5 commits intomainfrom
copilot/deep-report-add-pagination-guard
Apr 21, 2026
Merged

Guard list_code_scanning_alerts workflow usage to prevent MCP context overflow#27657
pelikhan merged 5 commits intomainfrom
copilot/deep-report-add-pagination-guard

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 21, 2026

list_code_scanning_alerts can return extremely large payloads and overflow agent context windows when called unfiltered. This updates workflow guidance to enforce bounded query patterns and clarifies head_limit compatibility.

  • Workflow prompt guardrails (code-scanning-fixer.md)

    • Require filtered usage for alert listing:
      • state: open
      • severity: critical,high
    • Clarify scope tradeoff: lower severities are intentionally excluded in this workflow to keep responses bounded.
    • Clarify head_limit behavior:
      • do not pass head_limit to the default GitHub MCP list_code_scanning_alerts tool
      • allow head_limit: 20 only for custom wrappers that explicitly support it
  • Structural-analysis workflow guidance (github-mcp-structural-analysis.md)

    • Replace “minimal params” wording with explicit guarded params for code security tool sampling.
    • Use precise terminology for default tool behavior vs. custom wrapper behavior.
  • Global authoring policy (AGENTS.md)

    • Add workflow-level rule to guard list_code_scanning_alerts calls in prompts with state: open + severity: critical,high.
    • Add explicit compatibility note for head_limit (default tool unsupported; custom wrappers only after documented verification).
# Recommended guarded pattern in workflow prompts
- owner: githubnext
- repo: gh-aw
- state: open
- severity: critical,high
# head_limit: 20   # only for custom wrappers that explicitly support it

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/compile GOINSECURE fips140/nistec ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env ternal/tools/generate-action-metadata/main.go cfg cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags -c 838403/b394/_pkg_.a EgAi/JW5fl0E13YyEocudEgAi ache/go/1.25.8/x64/pkg/tool/linu-nilfunc -n1 b/gh-aw/pkg/actiremote --end-of-options-v ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
    • Triggering command: /usr/bin/gh gh repo view owner/repo env 1231302108 wDwi/8TvZlM4P0nfuVfRvwDwi x_amd64/compile GOINSECURE contextprotocol/rev-parse GOMODCACHE x_amd64/compile -c er.test log rtcfg.link -n1 --format=format:config --end-of-options--get-regexp 9Ym34G_sfJyM6o-I^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ad3f59de95d43c10-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env effcfbcbb59500dd-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv -v 64/pkg/tool/linu--auto /usr/bin/gh 1180472357/.githgit om/modelcontextprev-parse 64/pkg/tool/linu--show-toplevel gh repo�� view owner/test-repo /usr/bin/git 873858/b234/_pkgnode oYmy/n_pwg_VDfKQ/opt/hostedtoolcache/node/24.14.1/x64/bin/npm x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv tagedFiles4169348203/001/workflow.md epo}/actions/runs/5/artifacts /usr/bin/git e GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git /001/inlined-b.mnode GO111MODULE ache/go/1.25.8/xinstall git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE n-dir/node git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/xinstall git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/TestCompileUpdateDiscussionFieldEnforcement3631210239/001 config /usr/bin/git remote.origin.urgit GO111MODULE x_amd64/vet git init�� GOMODCACHE l (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv GOMODCACHE go /usr/bin/git 79d3de8051cb52eagit GO111MODULE 64/bin/go git init�� GOMODCACHE go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv user.email test@example.com /usr/bin/git 2d34fb9cc97f75e3git GO111MODULE 64/bin/go git init�� GOMODCACHE go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv se 838403/b187/vet.nonexistent-workflow ache/go/1.25.8/x--limit -p internal/godebugadd -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -o /tmp/go-build470873858/b200/_pkg_.a -trimpath 1/x64/bin/node -p crypto/hkdf -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu-test.v=true /usr/bin/git /ref/tags/v9 FnMM/DTE1YZYN5-L\n x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git 4502-38402/test-git -trimpath ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git VVCpTXz34 -tests ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel rtcfg /usr/bin/git ripts/lint_errorgit ripts/lint_errorrev-parse 838403/b440/vet.--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260421-194502-38402/test-1516387851/.gith-test.timeout=10m0s config /usr/bin/git remote.origin.urgit -nolocalimports -importcfg git conf�� --get remote.origin.url ache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/vet git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv run --auto om/testorg/testrepo.git --detach GO111MODULE 64/bin/go git -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos_array_c3029187238/001 rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv for-each-ref --format=%(objectname) /usr/bin/git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu-tests /usr/bin/git ApprovalLabelsCogit -trimpath ache/go/1.25.8/x-b git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falgit /tmp/go-build189rev-parse 838403/b279/vet.--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git SameOutput177298git GO111MODULE ache/go/1.25.8/x-b git rev-�� --show-toplevel erignore /usr/bin/git 48910139/.githubgit GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/lib/git-core/git-remote-https SameOutput231637git GO111MODULE ache/go/1.25.8/x-b /usr/lib/git-corfeature-branch http�� REDACTED erignore /usr/bin/git 331789888 GO111MODULE flow.lock.yml git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json nal.go x_amd64/compile GOINSECURE GOMOD bytealg/indexbyt/tmp/go-build189838403/b424/_pkg_.a x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/gh ned-imports-enabgit itbranch_with_hyrev-parse 64/pkg/tool/linu--show-toplevel gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv user.name Test User /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE tions/setup/js/n--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --git-dir x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /tmp/go-build189838403/b466/_testmain.go /usr/bin/git 41P7GWbPK cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --git-dir go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/node git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/asm /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel resolved$ /usr/bin/git -json GO111MODULE tions/setup/js/n--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub/workflows/api-consumption-report.md --json /usr/bin/git l -nolocalimports -importcfg git init�� runs/20260421-194502-38402/test-277711731 /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-add-gitattributes-tes.artifacts[].name config /usr/bin/git remote.origin.urgit -nolocalimports -importcfg git -C /tmp/gh-aw-test-runs/20260421-195344-68079/test-1566632414/.gith.github/workflows/test.md remote /usr/bin/git -template-expresgh GO111MODULE modules/@npmcli/view git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel -goversion /usr/bin/git -c=4 -nolocalimports -importcfg git -C /tmp/gh-aw-test-runs/20260421-195927-92499/test-2983707258/.github/workflows rev-parse /usr/bin/infocmp -json GO111MODULE modules/@npmcli/--show-toplevel infocmp (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv e8fc8d8c..HEAD --stdout $name) { hasDiscussionsEnabled } } ion-test..token-git git ndor/bin/git git rev-�� HEAD e8fc8d8c..HEAD 1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node -m (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv e8fc8d8c..HEAD --stdout git ion-test..token-/bin/sh Initial commit e_modules/.bin/ggit commit -m 'Initial commit' git rev-�� HEAD e8fc8d8c..HEAD tions/setup/js/node_modules/.bin/node -m Token option basapi 86_64/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config $name) { hasDiscussionsEnabled } } remote.origin.urbash e8fc8d8c..HEAD DiscussionsEnabl--noprofile git s,Em�� ithub/workflows show x_amd64/compile HEAD e8fc8d8c 86_64/node x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/vet /usr/bin/git u-LDGAhfx cfg 64/pkg/tool/linu--show-toplevel git init�� GOMODCACHE 64/pkg/tool/linu-buildtags /usr/bin/infocmp 873858/b101/_pkggit cfg 64/pkg/tool/linu--show-toplevel infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE de_modules/.bin/--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv git git /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 49/001/test-emptgit GO111MODULE ode git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260421-194502-38402/test---workflow rev-parse /usr/bin/git 76426534/001' 76426534/001' x_amd64/compile git -C /tmp/gh-aw-test-runs/20260421-194502-38402/test-3435087809 remote 64/pkg/tool/linux_amd64/compile -json GO111MODULE x_amd64/compile 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -m (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -m l /opt/hostedtoolcache/node/24.14.1/x64/bin/node -c=4 -nolocalimports -importcfg node /tmp�� /tmp/TestHashConsistency_KeyOrdering3520845395/001/test1.md go /usr/bin/git h1408819357/001'gh h1408819357/001'repo 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv bility_SameInputSameOutput3415641670/001/stability-test.md -extld=gcc /usr/bin/git -json GO111MODULE x_amd64/compile git -C /tmp/gh-aw-test-runs/20260421-194502-38402/test-3435087809 s/test.md /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -json @v6.0.2/kind/kinrev-parse x_amd64/compile /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv Wuvn_aZ0mC8KJ8jqBghf/Wuvn_aZ0mC8KJ8jqBghf -goversion /usr/bin/git optimization)..git -nolocalimports -importcfg git -C /tmp/gh-aw-test-runs/20260421-195344-68079/test-3238188829/.github/workflows rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv GK58uBhFgW3lmqNzMCv9/GK58uBhFgW3lmqNzMCv9 -goversion /usr/bin/git optimization)..git -nolocalimports -importcfg git -C k/gh-aw/gh-aw/pkg/cli config /usr/bin/git l GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 873858/b007/syma--show-toplevel 64/pkg/tool/linux_amd64/vet env 558558642/.github/workflows fWCy/na03iXLzDBM34i--fWCy ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE /semver GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-extld=gcc (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140only 873858/b029/syma--show-toplevel 64/pkg/tool/linux_amd64/vet env 873858/b194/_pkg_.a wyMD/ZnqvKWWFy1YdeRMpwyMD 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE k/gh-aw/gh-aw/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� 5344-68079/test-2691150612/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE /execenv GOMODCACHE pBvTgXO/G1KutSxXTest User env 4267544515 vNkW/MmwpPo_3e3tB-Au8vNkW cfg GOINSECURE g/x/net/http2/hprev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE l/buffer GOMODCACHE 64/pkg/tool/linuTest User rtcf�� 1231302108 tmain.go cfg GOINSECURE contextprotocol/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE k/gh-aw/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE rtcfg env 5344-68079/test-1566632414/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE randutil GOMODCACHE 64/pkg/tool/linutest@example.com env 4267544515 SZyr/UNQkpBpW_IvLZuHOSZyr 64/pkg/tool/linux_amd64/compile GOINSECURE g/x/text/secure/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 om/modelcontextprotocol/go-sdk@v1.5.0/internal/j-ifaceassert 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE sY5xy3c/9ezsDU_VWw7VJguVlRAx env 1231302108 gNV_/-ERQMY_tDmUJytyNgNV_ til.test GOINSECURE g/x/net/idna GOMODCACHE til.test (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE k/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE rtcfg env 5344-68079/test-1566632414/.gith.github/workflows/test.md GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD ode-gyp-bin/node--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build189838403/b112/vet.cfg env 558558642/.github/workflows k-ff/hcoMcb4nJlDk1Ubnk-ff ache/go/1.25.8/x64/pkg/tool/linu-nolocalimports GOINSECURE b/gh-aw/pkg/giturev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build189838403/b115/vet.cfg env 873858/b162/_pkg_.a DUdE/2oEXO76xEThYfB4YDUdE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE th2/internal GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE k/gh-aw/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� 5344-68079/test-2691150612/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name rg/x/text@v0.36.0/internal/language/common.go 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 873858/b007/syma--show-toplevel 64/pkg/tool/linux_amd64/vet ache�� 873858/b245/_pkg_.a 7Ps3/Xuna8G_bMUX3GMM57Ps3 cfg GOINSECURE t/internal/strinrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-dwarf=false (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE 873858/b092/ ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/vet env 742976993/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/numberev-parse ache/go/1.25.8/x--show-toplevel ache/go/1.25.8/x64/pkg/tool/linu-buildtags (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name efaultBranchFromLsRemoteWithRealGitmaster_branch1682022520/001' k/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� 5344-68079/test-2691150612/.github/workflows GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 873858/b013/syma--show-toplevel 64/pkg/tool/linux_amd64/vet env 873858/b241/_pkg_.a r73k/ZR15bOYtzO_sNGC5r73k ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe GOINSECURE t/internal/langurev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-extld=gcc (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/aes/gcm GOMODCACHE Vgol9MA/jtMHmSR1PwQ4sKWnT8ry env 873858/b228/_pkg_.a ho52/RILG8Ja3npv64jHUho52 k GOINSECURE l/httpcommon GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-goversion (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE e_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 558558642/.github/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuconfig (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 873858/b029/syma--show-toplevel 64/pkg/tool/linux_amd64/vet env 3004960373/custom/workflows 4ACQ/f02Eva1ttQPQuPWq4ACQ ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE th2 GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go t-ha�� Imports205543663/001/inlined-b.md GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD erignore go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -c=4 -nolocalimports -importcfg /tmp/go-build189838403/b419/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 873858/b078/ GOMODCACHE x_amd64/link env 873858/b142/_pkg_.a GO111MODULE x_amd64/link GOINSECURE contextprotocol/rev-parse 873858/b078/syma--show-toplevel x_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build189838403/b404/cli.test /tmp/go-build189838403/b404/cli.test -test.testlogfile=/tmp/go-build189838403/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /tmp/go-build4208800795/b404/cli.test /tmp/go-build4208800795/b404/cli.test -test.testlogfile=/tmp/go-build4208800795/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build2255052280/b404/cli.test /tmp/go-build2255052280/b404/cli.test -test.testlogfile=/tmp/go-build2255052280/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git se 838403/b106/vet.rev-parse cfg git rev-�� --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git go t.go 1/x64/bin/node git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv xterm-color go /usr/bin/git BA0Wx4HVL GO111MODULE k/gh-aw/gh-aw/ac--show-toplevel git rev-�� --show-toplevel rtcfg /usr/bin/git 5344-68079/test-ls GO111MODULE ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git vaScript24259153git GO111MODULE k/node_modules/.--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git 5927-92499/test-ls GO111MODULE 64/pkg/tool/linu/tmp/gh-aw/aw-feature-branch.patch git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 838403/b013/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 873858/b133/syma--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE ions-lock.json does not exist yeremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE h GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build189838403/b431/importcfg -pack /tmp/go-build189838403/b431/_testmain.go env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD sm_wasm.s x_amd64/vet env lGitmain_branch4176426534/001' lGitmain_branch4176426534/001' x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env 6426534/001 6426534/002/work x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env Gitmaster_branch2292142342/001' Gitmaster_branch2292142342/001' 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv _.a 838403/b011/vet.cfg 64/pkg/tool/linux_amd64/vet GOINSECURE ole GOMODCACHE 64/pkg/tool/linux_amd64/vet -o oMM2kMrQi -trimpath ache/go/1.25.8/x64/pkg/tool/linu-test.short=true -p unicode/utf16 -lang=go1.25 rtcfg (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 86_64/sh GOINSECURE GOMOD GOMODCACHE go itbr�� '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json GO111MODULE 8d519d9/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env LsRemoteWithRealGitmain_branch427413318/001' LsRemoteWithRealGitmain_branch427413318/001' tions/setup/js/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE /go-yaml/printerrev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD erignore ache/go/1.25.8/x^remote\..*\.gh-resolved$ env -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo env ithub/workflows GO111MODULE /opt/hostedtoolcache/node/24.14.1/x64/bin/npm GOINSECURE GOMOD s,MFiles,HFiles,xterm-color npm (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json age/compact/comp-ifaceassert x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 8738�� t3193833143/.github/workflows -Eee/499QsILxkBjFfa_H-Eee cfg -buildmode=exe -buildid=wjnN3Pgconfig -s ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE /sh GOINSECURE GOMOD GOMODCACHE go env f3a0ac9b2bd3cdad-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 3ee6a87ccabf9119-d GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 873858/b235/_pkg_.a h5RJ/fhSiz4P0ozPJ9_2Hh5RJ ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE osh-tekuri/jsonsrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-goversion (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch GOMODCACHE l /usr/bin/git -json GO111MODULE 64/bin/go git -C /tmp/gh-aw-test-runs/20260421-195344-68079/test-2827484606/.github/workflows rev-parse /usr/bin/git ath ../../../.prgit GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branchremote.origin.urgh l e/git -json GO111MODULE 64/bin/go e/git rev-�� --git-dir go /usr/bin/git led-with-body-cogh GO111MODULE 64/bin/go git (http block)
  • invalid.example.invalid
    • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git conf�� --local --get ode_modules/.bin/git cal/bin/git git /git git add . git tions/setup/node_modules/.bin/git -M main bin/git git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI and others added 4 commits April 21, 2026 19:48
This reverts commit ad2f9e8.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Add pagination guard to list_code_scanning_alerts for context overflow Guard list_code_scanning_alerts workflow usage to prevent MCP context overflow Apr 21, 2026
Copilot AI requested a review from pelikhan April 21, 2026 20:08
@pelikhan pelikhan marked this pull request as ready for review April 21, 2026 20:08
Copilot AI review requested due to automatic review settings April 21, 2026 20:08
@pelikhan pelikhan merged commit eda7280 into main Apr 21, 2026
20 checks passed
@pelikhan pelikhan deleted the copilot/deep-report-add-pagination-guard branch April 21, 2026 20:08
@github-actions github-actions Bot mentioned this pull request Apr 21, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates workflow/policy documentation to prevent oversized list_code_scanning_alerts responses (and resulting agent context overflows) by requiring bounded query parameters and clarifying head_limit support expectations.

Changes:

  • Add global guidance to always filter list_code_scanning_alerts by state: open and severity: critical,high.
  • Update structural-analysis workflow guidance to use explicit guarded params and clarify head_limit compatibility.
  • Narrow the code-scanning fixer workflow guidance to critical/high only and document the tradeoff + head_limit rules.
Show a summary per file
File Description
AGENTS.md Adds repo-wide authoring rules to guard list_code_scanning_alerts usage and clarify head_limit compatibility expectations.
.github/workflows/github-mcp-structural-analysis.md Updates the “minimal params” sampling guidance to explicitly require bounded code scanning alert queries.
.github/workflows/code-scanning-fixer.md Revises workflow guidance to list/process only critical/high alerts and documents why (context bounds) + head_limit guidance.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

.github/workflows/code-scanning-fixer.md:88

  • This section still frames the call as listing “all open code scanning alerts”, but the new required severity: "critical,high" filter changes the behavior. Please update the surrounding wording (and/or the section header) to match the high-risk-only scope so the instructions don’t contradict the parameters being sent.
  - `owner`: "githubnext" (the repository owner)
  - `repo`: "gh-aw" (the repository name)
  - `state`: "open"
  - `severity`: "critical,high" (required to prevent oversized MCP responses)
- Medium/low/warning/note/error are intentionally excluded in this workflow so each run stays within MCP context limits

.github/workflows/code-scanning-fixer.md:92

  • The instructions say medium/low (and others) are intentionally excluded, but the next bullet still tells the agent to sort by a severity order that includes those excluded levels. Please update the sorting guidance to only reference severities that can actually appear in the filtered results (e.g., critical > high).
- Medium/low/warning/note/error are intentionally excluded in this workflow so each run stays within MCP context limits
- Do NOT send `head_limit` to the default GitHub MCP tool (`list_code_scanning_alerts` does not support it)
- If using a custom wrapper that explicitly documents `head_limit`, you may use `head_limit: 20`
- Sort the results by severity (prioritize: critical > high > medium > low > warning > note > error)
- If no open alerts are found, log "No unfixed security alerts found. All alerts have been addressed!" and exit gracefully
  • Files reviewed: 3/3 changed files
  • Comments generated: 1

Comment on lines +63 to 64
2. **List open high-risk alerts**: Find open critical/high code scanning alerts (prioritizing critical over high)
3. **Select an unfixed alert**: Pick the highest severity unfixed alert that hasn't been fixed recently
Copy link

Copilot AI Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow now scopes itself to critical/high alerts, but the surrounding text still implies it handles “all severity levels” (see the earlier intro) and selects from “all open alerts”. Please update the description/wording to consistently reflect the high-risk-only scope so readers don’t expect medium/low handling from this workflow.

This issue also appears in the following locations of the same file:

  • line 84
  • line 88

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[deep-report] Add pagination/truncation guard to list_code_scanning_alerts MCP tool usage — 145K char context overflow

3 participants