Allow `vulnerability-alerts` in GitHub Actions schema validation for compiled workflows by Copilot · Pull Request #28078 · github/gh-aw

Copilot · 2026-04-23T12:36:08Z

Agentic Maintenance started failing at compile-workflows because dependabot-go-checker.md includes permissions.vulnerability-alerts: read, but the schema used during compile validation did not allow that key at job level. This blocked successful compilation of all workflows.

Schema patching (source of truth)
- Updated patch-github-actions-schema in Makefile to patch both custom permission keys into definitions.permissions-event.properties:
  - copilot-requests: ["write","none"]
  - vulnerability-alerts: ["read","none"]
- This ensures future schema refreshes keep both project-required permissions.
Checked-in schema update
- Added vulnerability-alerts to pkg/workflow/schemas/github-workflow.json under permissions-event so current validation accepts job-level usage immediately.
Focused schema regression coverage
- Extended pkg/workflow/schema_validation_test.go with a case asserting a workflow with job-level:
```
jobs:
  test:
    permissions:
      vulnerability-alerts: read
```
  validates successfully.

Example of the now-supported permission block:

permissions:
  contents: read
  actions: read
  issues: read
  pull-requests: read
  security-events: read
  vulnerability-alerts: read

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/nistec/finit ache/go/1.25.8/x64/src/runtime/iadd 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh repo view owner/repo env ternal/tools/generate-action-metadata/main.go ahb4/lZep-2MiwczJtV1iahb4 64/pkg/tool/linux_amd64/link GOINSECURE fips140/ecdh GOMODCACHE Vp/-NQyIY17MeaXWF6buppr/PgQYLZc0-test.v=true -c ger.test _L0m/ZbUGNwZMKnO7zDW0_L0m ortcfg.link -n1 b/gh-aw/pkg/acticonfig --end-of-options--get-regexp 9Ym34G_sfJyM6o-I^remote\..*\.gh-resolved$ (http block)
- Triggering command: /usr/bin/gh gh repo view owner/repo env 1821154515 qrnP/bIu9B-2Kyy25-yTJqrnP .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg -V=f�� 4012952/b395/_pkg_.a zUvD/O0MXJnxKO-Hqrk06zUvD .cfg GOSUMDB GOWORK 64/bin/go ache/go/1.25.8/x12345 (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json gset/set.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name '**/*.ts' '**/*.GOINSECURE GO111MODULE ache/go/1.25.8/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE GiHOGlTXgehC env .js' --ignore-paGOINSECURE GO111MODULE af00d638b16b439b-d GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv -v 64/pkg/tool/linustatus /usr/bin/git 1089149168/.githgit .cfg 64/pkg/tool/linu--show-toplevel git -C /tmp/gh-aw-test-runs/20260423-124745-35893/test-4110232193 rev-parse /usr/bin/git 9552940/b238/_pknode .cfg ache/go/1.25.8/xinstall git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git or.md **/*.cjs 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 49674697/001 GO111MODULE 64/pkg/tool/linuinstall git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv GOMODCACHE x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/vet node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript3076124798/001/test-inlined-imports-enab-p x_amd64/vet /usr/lib/git-core/git -json GO111MODULE x_amd64/vet /usr/lib/git-core/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260423-125508-56833/test-2427900472 remote om/org1/repo1.git g_.a GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md go /opt/hostedtoolcache/node/24.14.1/x64/bin/node vnWWu0HIT GO111MODULE 64/bin/go /opt/hostedtoolcache/node/24.14.1/x64/bin/node (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 9552940/b210/importcfg o ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p path -lang=go1.25 ache/go/1.25.8/x--name-only -o 3232967218 -trimpath 4012952/b186/vet.cfg -p crypto/rc4 -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linu-tests (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel /tmp/gh-aw-merge-2305414898/new.md /usr/bin/git se 4012952/b050/vet\n .cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu-trimpath /usr/bin/git 4745-35893/test-git pkg/mod/golang.orev-parse ache/go/1.25.8/x--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git ithub/workflows/git --initial-branchrev-parse 1/x64/bin/node git 1/x6�� --show-toplevel git /usr/bin/git ithub/workflows/git remote /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv sistency_InlinedImports2704337131/001/inlined-b.md x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git -C /tmp/gh-aw-test-runs/20260423-124745-35893/test--s l /usr/bin/git remote.origin.urgit GO111MODULE x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 -buildtags sv -errorsas -ifaceassert -nilfunc git -C /tmp/TestGuardPolicyTrustedUsersRequiresMinInteg-errorsas rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuremote1 /usr/bin/git se 4012952/b211/vetcommit outil.test git rev-�� --show-toplevel outil.test /usr/bin/git 4012952/b410/_pkgit /tmp/go-build116rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x-m git rev-�� --show-toplevel go /usr/bin/git 5508-56833/test-git GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile abi/�� -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD bytealg/compare_--show-toplevel x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url /opt/hostedtoolcache/node/24.14.1/x64/bin/node ata/action_pins.git DFryr79XR 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� GOMODCACHE xf9qL--/YcBrNqCW--auto /usr/bin/git ortcfg GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git ub/workflows GO111MODULE 64/bin/go git rev-�� --show-toplevel node /usr/bin/git prettier --check 64/bin/go git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_only_defaults_repo1338667272/001 remote /usr/bin/gh -json GO111MODULE x_amd64/compile gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linuorigin /opt/hostedtoolcache/node/24.14.1/x64/bin/node y-frontmatter.mdgit .cfg 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� No expressions here 64/pkg/tool/linu-importcfg /usr/bin/git ty-test.md .cfg 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git init�� -stringintconv -tests om/myorg/repo.git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ons-test1999125525 -dwarf=false /usr/bin/git go1.25.8 -c=4 -nolocalimports git rev-�� --show-toplevel /tmp/go-build1164012952/b424/_testmain.go /usr/bin/git -json nal.go x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --bare l /usr/bin/git -json GO111MODULE 1/x64/lib/node_m--show-toplevel git -C /tmp/gh-aw-test-runs/20260423-125508-56833/test-remote.origin.url remote /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node ortcfg .cfg 64/pkg/tool/linu--show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� steps.test.outputs.result 64/pkg/tool/linuInitial commit /usr/bin/git ortcfg GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv Safe: ${{ github.actor }}, Unsafe: ${{ secrets.TOKEN }} go /usr/bin/git ty-test.md GO111MODULE 64/bin/go git rev-�� --show-toplevel sh /usr/bin/git npx prettier --cgit GOPROXY 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260423-124745-35893/test-test-logs/run-12346 remote /usr/bin/git h3390074824/001'git h3390074824/001'rev-parse x_amd64/compile git -C /tmp/gh-aw-test-runs/20260423-124745-35893/test-1821154515 remote 4012952/b455/vet.cfg -json GO111MODULE x_amd64/link git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md --initial-branch=my-default /usr/bin/git go1.25.8 -c=4 -nolocalimports git -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos_array_c202471952/001 config /usr/bin/git remote.origin.urgit GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv t0 rev-parse (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch3987755439/001' l /usr/bin/git -json GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel go ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.1/x64/bin/node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD 9552940/b007/sym--show-toplevel 64/pkg/tool/linu/tmp/go-build1164012952/b456/_testmain.go ache�� 9552940/b242/_pkg_.a 7Ps3/Xuna8G_bMUX3GMM57Ps3 x_amd64/compile GOINSECURE t/internal/tag GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE /cpu GOMODCACHE 64/pkg/tool/linux_amd64/vet env 9552940/b235/_pkg_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE osh-tekuri/jsonsrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuGOPROXY -o ut653723696/001 -trimpath 64/pkg/tool/linux_amd64/asm -p github.com/githuinit -lang=go1.25 64/pkg/tool/linux_amd64/asm (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE randutil GOMODCACHE 64/pkg/tool/linuTest User env 918987570 SZyr/UNQkpBpW_IvLZuHOSZyr x_amd64/vet GOINSECURE l/ascii GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User ortc�� 1821154515 stmain.go eutil.test GOINSECURE fips140/ecdsa GOMODCACHE eutil.test (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcremote1 -o y_with_repos=public_681779588/00remote.origin.url -trimpath ache/go/1.25.8/x64/bin/go -p main -lang=go1.25 go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env 918987570 aMu6/n6X7R7Av3bGkLZAPaMu6 .cfg GOINSECURE contextprotocol/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE fips140/aes GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1821154515 qrnP/bIu9B-2Kyy25-yTJqrnP .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/xremote -o 57/001/test-inlined-imports-enabled-with-env-template-expressions-in-body.md -trimpath ache/go/1.25.8/x64/bin/go -p main -lang=go1.25 go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name rg/x/text@v0.36.-ifaceassert 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD 9552940/b013/sym--show-toplevel 64/pkg/tool/linu-tests env 9552940/b241/_pkg_.a 9552940/b013/importcfg x_amd64/compile GOINSECURE t/internal/langurev-parse GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE ntio/asm/cpu/x86rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet env 670186484/custom/workflows GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE th2 GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name k/gh-aw/gh-aw/pkg/workflow/import_schema_test.goGOMOD 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuGOPROXY -o /tmp/go-build3275532832/b396/_pkg_.a -trimpath 64/pkg/tool/linux_amd64/cgo -p main -lang=go1.25 64/pkg/tool/linuorigin (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD 9552940/b007/symabis 64/pkg/tool/linux_amd64/vet env 3660942667/.github/workflows taK6/ikh7gQ1RReQdq87ptaK6 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE t/internal/strinrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE light 9552940/b029/sym--show-toplevel 64/pkg/tool/linux_amd64/vet env 9552940/b225/_pkg_.a 28ie/dWadUuI3oiBsYAOo28ie k GOINSECURE ce GOMODCACHE ylQP4Z8/vCNYLdc7D8RXanEmFBss (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK run-script/lib/nREDACTED.os go list�� mpiledOutput2768165036/001 -json ache/go/1.25.8/x64/bin/go -json GO111MODULE 64/bin/go go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE ntio/asm/cpu/arm-unsafeptr=false GOMODCACHE 64/pkg/tool/linu/tmp/go-build1164012952/b115/vet.cfg env 670186484/custom/workflows GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/xrev-parse -o mpiledOutput2768165036/001 -trimpath 64/pkg/tool/linux_amd64/vet -p main -lang=go1.25 64/pkg/tool/linuTest User (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env 3660942667/.github/workflows fWCy/na03iXLzDBM34i--fWCy ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE b/gh-aw/pkg/gitu/tmp/js-hash-test-276741613/test-hash.js GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu/tmp/file-tracker-test3715812727/test2.lock.yml (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE b/gh-aw/pkg/consrev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet env 9552940/b199/_pkg_.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name **/*.ts 64/bin/go --ignore-path ../../../.prettirev-parse 64/bin/go go env mpiledOutput2768165036/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path -c=4 -nolocalimports -importcfg /tmp/go-build1164012952/b419/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json o x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/vet env successfully" GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build1164012952/b404/cli.test /tmp/go-build1164012952/b404/cli.test -test.testlogfile=/tmp/go-build1164012952/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /tmp/go-build3460200401/b404/cli.test /tmp/go-build3460200401/b404/cli.test -test.testlogfile=/tmp/go-build3460200401/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE n-dir/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x--json /usr/bin/git P82kiP9ch -trimpath ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linutest@example.com /usr/bin/git se stmain.go ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git sRemoteWithRealGgit sRemoteWithRealGrev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc/tmp/gh-aw/aw-feature-branch.patch git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv se 4012952/b009/vet.cfg .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env t3864637569/.github/workflows GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv go GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json d6c9ccce62b9c87e0 x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv s/data/action_pins.json..." GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� 86476169/001 86476169/002/work 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv bytealg/indexbyte_wasm.s GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD sm_wasm.s x_amd64/vet env lGitmain_branch4-errorsas lGitmain_branch4-ifaceassert x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json poll/fd.go x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE erignore (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv se 4012952/b006/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xremote.origin.url (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv ithub/workflows GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link env ser.test GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE qDtycTQd8Qy5k5aLVp/-NQyIY17MeaXWF6buppr/PgQYLZc0GiHOGlTXgehC (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE 9552940/b133/ GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion tierignore git 64/bin/go go env ithub/workflows GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json age.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state x_amd64/vet GOINSECURE l/ascii GOMODCACHE x_amd64/vet buil�� t2250257670/.github/workflows -ZkR/Y5KUpR6ZrQZn8hJV-ZkR .cfg ./cmd/gh-aw-wasmgh GOWORK 64/bin/go ache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/12346/artifacts (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name '**/*.ts' '**/*.GOINSECURE GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-paGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 9552940/b235/_pkg_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE osh-tekuri/jsonsrev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch edOutput2767671777/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/715ef806-e246-4d70-b135-a9167e447f12 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Updates the embedded GitHub Actions workflow JSON schema (and its refresh/patch process) to allow permissions.vulnerability-alerts: read—unblocking compile-workflows validation for workflows that set this permission at the job level.

Changes:

Added vulnerability-alerts (enum: read|none) to definitions.permissions-event.properties in the checked-in schema.
Updated make patch-github-actions-schema to patch both copilot-requests and vulnerability-alerts into the schema after refresh.
Extended schema validation tests to assert job-level permissions.vulnerability-alerts: read validates successfully.

Show a summary per file

File	Description
pkg/workflow/schemas/github-workflow.json	Extends `permissions-event` schema to accept `vulnerability-alerts`.
pkg/workflow/schema_validation_test.go	Adds a regression test validating job-level `vulnerability-alerts: read`.
Makefile	Updates schema patching to apply both custom permission keys during schema refresh.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 0

github-actions · 2026-04-23T13:09:49Z

🧪 Test Quality Sentinel Report

Test Quality Score: 70/100

⚠️ Acceptable, with suggestions

Metric	Value
New/modified tests analyzed	1 (table row)
✅ Design tests (behavioral contracts)	1 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	0 (0%)
Duplicate test clusters	0
Test inflation detected	No
🚨 Coding-guideline violations	None

Test Classification Details

Test	File	Classification	Issues Detected
`"vulnerability-alerts permission in job permissions passes"` (table row in `TestValidateGitHubActionsSchemaWithExamples`)	`pkg/workflow/schema_validation_test.go:~213`	✅ Design	Happy-path only; missing error case for invalid values

Flagged Tests — Requires Review

⚠️ `"vulnerability-alerts permission in job permissions passes"` (`pkg/workflow/schema_validation_test.go`)

Classification: Design test (behavioral contract) — but happy-path only
Issue: The test verifies that vulnerability-alerts: read is accepted by schema validation, which is the correct behavioral contract. However, there is no corresponding negative test row to confirm that invalid values (e.g., vulnerability-alerts: write) are rejected. The schema enum is ["read", "none"], so write should fail — but this is not tested.
What design invariant does this test enforce? That the schema allows the vulnerability-alerts: read permission without error.
What would break if deleted? A regression that accidentally removed vulnerability-alerts from the schema would go undetected.
Suggested improvement: Add a second table row with expectError: true and an invalid value such as vulnerability-alerts: write, to verify the schema also rejects disallowed values. Example:

{
    name: "vulnerability-alerts with invalid value fails",
    yamlContent: `
name: Test
on: push
jobs:
  test:
    permissions:
      vulnerability-alerts: write
    runs-on: ubuntu-latest
    steps:
      - run: echo hello
`,
    expectError: true,
},

Language Support

Tests analyzed:

🐹 Go (*_test.go): 1 test row — unit (//go:build !integration)
🟨 JavaScript (*.test.cjs, *.test.js): 0 tests

Verdict

✅ Check passed. 0% of new tests are implementation tests (threshold: 30%). No coding-guideline violations detected. Score is 70/100 — deduction is due to the absence of an error-path test for invalid vulnerability-alerts values.

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

Assert on observable outputs, return values, or state changes
Cover error paths and boundary conditions
Would catch a behavioral regression if deleted
Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

Assert on internal function calls (mocking internals)
Only test the happy path with typical inputs
Break during legitimate refactoring even when behavior is correct
Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

References: §24836867150

🧪 Test quality analysis by Test Quality Sentinel · ● 588.5K · ◷

github-actions

✅ Test Quality Sentinel: 70/100. Test quality is acceptable — 0% of new tests are implementation tests (threshold: 30%). The single new test row is a valid behavioral contract test. Consider adding a negative test case for invalid vulnerability-alerts values to improve edge case coverage.

Initial plan

f37b337

Copilot AI assigned Copilot and pelikhan Apr 23, 2026

Copilot AI linked an issue Apr 23, 2026 that may be closed by this pull request

[P1] dependabot-go-checker compilation failure breaks Agentic Maintenance #28061

Closed

Copilot started work on behalf of pelikhan April 23, 2026 12:37 View session

Copilot AI and others added 2 commits April 23, 2026 12:49

chore: start plan for vulnerability-alerts schema fix

e63478e

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/715ef806-e246-4d70-b135-a9167e447f12 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: allow vulnerability-alerts in patched GitHub Actions schema

2cf2424

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/715ef806-e246-4d70-b135-a9167e447f12 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix dependabot-go-checker compilation failure~~ Allow vulnerability-alerts in GitHub Actions schema validation for compiled workflows Apr 23, 2026

Copilot finished work on behalf of pelikhan April 23, 2026 13:02

Copilot AI requested a review from pelikhan April 23, 2026 13:02

pelikhan approved these changes Apr 23, 2026

View reviewed changes

pelikhan marked this pull request as ready for review April 23, 2026 13:04

Copilot AI review requested due to automatic review settings April 23, 2026 13:04

pelikhan merged commit 46b088e into main Apr 23, 2026
16 of 19 checks passed

pelikhan deleted the copilot/fix-dependabot-go-checker-compilation-failure branch April 23, 2026 13:05

Copilot started reviewing on behalf of pelikhan April 23, 2026 13:05 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 23, 2026

[aw] No-Op Runs #27675

Open

github-actions Bot approved these changes Apr 23, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 23, 2026

Smoke Test: Claude - 24837114207 #28087

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow `vulnerability-alerts` in GitHub Actions schema validation for compiled workflows#28078

Allow `vulnerability-alerts` in GitHub Actions schema validation for compiled workflows#28078
pelikhan merged 3 commits intomainfrom
copilot/fix-dependabot-go-checker-compilation-failure

Copilot AI commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Apr 23, 2026

🧪 Test Quality Sentinel Report

Test Quality Score: 70/100

Test Classification Details

Flagged Tests — Requires Review

⚠️ "vulnerability-alerts permission in job permissions passes" (pkg/workflow/schema_validation_test.go)

Language Support

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 23, 2026 •

edited

Loading

⚠️ `"vulnerability-alerts permission in job permissions passes"` (`pkg/workflow/schema_validation_test.go`)