feat: place threat detection CAUTION alert at top of PR body and add agentic-threat-detected label by Copilot · Pull Request #28429 · github/gh-aw

Copilot · 2026-04-25T11:04:30Z

Summary

Changes the rendering order of the pull request body so that the threat detection warning/caution alert appears at the top of the body (immediately visible to reviewers) rather than just before the footer. Also adds an agentic-threat-detected label to the PR when threat detection produces a warning.

Changes

`actions/setup/js/messages_footer.cjs`

Merged duplicate JSDoc blocks into a single JSDoc comment (with @param {GenerateFooterOptions} [options] and @returns {string}) immediately preceding generateFooterWithMessages
Added GenerateFooterOptions typedef with a skipDetectionCaution property
Added optional options parameter to generateFooterWithMessages
When skipDetectionCaution: true is passed, the caution alert is omitted from the footer (avoids duplication when the caller has already placed it at the top of the body)

`actions/setup/js/create_pull_request.cjs`

Imports getDetectionCautionAlert from messages_footer.cjs
After workflowName/runUrl are resolved, gets the detection caution alert
If threat is detected, prepends the caution alert to the very top of bodyLines (before any agent-generated content) with two blank separator lines for proper visual spacing
Adds agentic-threat-detected label to the PR's label list when a threat warning is present
Passes { skipDetectionCaution: true } to generateFooterWithMessages to prevent the alert from being duplicated in the footer

`actions/setup/js/create_pull_request.test.cjs`

Added a new create_pull_request - threat detection caution describe block with 5 tests:
- Caution alert is prepended before agent body content when GH_AW_DETECTION_CONCLUSION=warning
- No caution alert in PR body when conclusion is not warning
- agentic-threat-detected label is included in addLabels call when warning
- agentic-threat-detected label is absent when conclusion is not warning
- At least two blank lines separate the caution block from body content

Before / After

Before (threat detected):

### Agent-generated title

Main body content...

> [!CAUTION]
> **Security scanning requires review**

> Generated by [Workflow](...)

After (threat detected):

> [!CAUTION]
> **Security scanning requires review**


### Agent-generated title

Main body content...

> Generated by [Workflow](...)

Labels on PR now include: agentic-threat-detected

Testing

All 71 JavaScript tests pass (5 new threat-detection tests added)
TypeScript type checks clean
make fmt passes

…agentic-threat-detected label - Prepend the threat detection caution alert to the very top of the PR body in `create_pull_request.cjs` so it is immediately visible to reviewers - Add `agentic-threat-detected` label to the PR when threat detection produces a warning - Add `skipDetectionCaution` option to `generateFooterWithMessages` in `messages_footer.cjs` to avoid duplicating the caution alert in the footer when it has already been placed at the top of the body - Import `getDetectionCautionAlert` in `create_pull_request.cjs` - All 7045 JS tests pass, TypeScript checks clean Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d90da164-04bf-4b03-8ae9-c721d2b3e1b7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d90da164-04bf-4b03-8ae9-c721d2b3e1b7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-25T11:08:05Z

@copilot ensure extra new lines when caution inserted

…lert Agent-Logs-Url: https://github.com/github/gh-aw/sessions/adab9e29-e34d-4824-93fb-79d65c01e8a1 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-25T11:12:07Z

@copilot ensure extra new lines when caution inserted

Fixed in 39f92b3 — changed unshift(detectionCaution, "") to unshift(detectionCaution, "", "") so two blank lines separate the caution alert from the main body content.

Copilot

Pull request overview

Updates PR body rendering so threat-detection CAUTION alerts are immediately visible at the top of the PR description, and tags PRs with a dedicated label when a threat warning is present.

Changes:

Add an options parameter to generateFooterWithMessages to allow omitting the detection caution from the footer.
Prepend the threat-detection CAUTION block to the top of newly created PR bodies when detection concludes “warning”.
Add agentic-threat-detected to the PR label list when a threat warning is present.

Show a summary per file

File	Description
`actions/setup/js/messages_footer.cjs`	Adds `skipDetectionCaution` option to prevent duplicating the detection CAUTION in the footer.
`actions/setup/js/create_pull_request.cjs`	Prepends detection CAUTION to the top of PR body and appends an `agentic-threat-detected` label on warning.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

actions/setup/js/messages_footer.cjs:422

skipDetectionCaution adds new behavior (omitting the detection caution from the footer), but there doesn’t appear to be any test coverage exercising the new options parameter. Please add a unit test (e.g., in actions/setup/js/messages.test.cjs) that sets GH_AW_DETECTION_CONCLUSION=warning and asserts the caution is present by default and absent when { skipDetectionCaution: true } is passed.

  const { skipDetectionCaution = false } = options || {};

  // Collect guard notices to show BEFORE the attribution footer
  let guardNotices = "";

actions/setup/js/create_pull_request.cjs:930

bodyLines.unshift(detectionCaution, "", "") results in two blank lines between the caution block and the rest of the body (because the caution string is followed by three consecutive \n when joined). If the intent is a single blank separator line (as described), consider unshifting only one empty string (or update the comment/PR description to reflect the extra spacing).

      // unshift(caution, "", "") places the caution alert at index 0 and two blank
      // separator lines so the main body content follows after a full empty line.
      bodyLines.unshift(detectionCaution, "", "");
    }

Files reviewed: 2/2 changed files
Comments generated: 3

Copilot · 2026-04-25T11:21:09Z

 * @param {string|null|undefined} [historyUrl] - GitHub search URL for items created by this workflow
 * @returns {string} Complete footer text
 */


There are now two JSDoc blocks describing generateFooterWithMessages back-to-back (one ending at @returns here, then another starting below). The first block is effectively orphaned/duplicative after inserting the typedef and can confuse tooling/ts-check—please remove it or merge into a single JSDoc immediately preceding the function.

This issue also appears on line 418 of the same file.

Copilot · 2026-04-25T11:21:10Z

+    // Prepend threat detection caution alert at the very top of the PR body so it is
+    // immediately visible to reviewers. The caution is omitted from the footer to
+    // avoid duplication (skipDetectionCaution is passed to generateFooterWithMessages).
+    const detectionCaution = getDetectionCautionAlert(workflowName, runUrl);
+    if (detectionCaution) {


The new behavior of prepending the threat-detection caution to the top of the PR body isn’t covered by tests in create_pull_request.test.cjs (no scenarios set GH_AW_DETECTION_CONCLUSION=warning and assert body ordering). Please add a test that verifies the caution appears at the very beginning of the generated PR body when detection is warning, and that it is absent when detection is not warning.

This issue also appears on line 927 of the same file.

Copilot · 2026-04-25T11:21:10Z

+    // Add agentic-threat-detected label when threat detection produced a warning
+    if (detectionCaution && !labels.includes("agentic-threat-detected")) {
+      labels.push("agentic-threat-detected");
+    }


Adding the agentic-threat-detected label based on threat-detection warnings is new behavior, but there’s no test coverage in create_pull_request.test.cjs asserting the label set includes it when GH_AW_DETECTION_CONCLUSION=warning (and does not include it otherwise). Please add/extend a test to validate the labels passed to issues.addLabels in both cases.

pelikhan · 2026-04-25T11:25:22Z

@copilot Review all tests

…essages_footer Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f36dc55f-6578-4446-b624-09990dcd9eca Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-04-25T11:33:06Z

@copilot Review all tests

Done in 2000285. Added 5 new tests in a create_pull_request - threat detection caution describe block covering:

Caution alert prepended to top of PR body when GH_AW_DETECTION_CONCLUSION=warning
No caution alert when conclusion is not warning
agentic-threat-detected label added when warning
agentic-threat-detected label absent when not warning
At least 2 blank lines separating the caution block from body content

Also fixed the duplicate JSDoc block in messages_footer.cjs (merged the two back-to-back JSDoc comments into a single block with the @returns tag).

Copilot AI and others added 2 commits April 25, 2026 11:02

fix: add clarifying comment for blank separator line after caution alert

37daead

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d90da164-04bf-4b03-8ae9-c721d2b3e1b7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Apr 25, 2026

Copilot created this pull request from a session on behalf of pelikhan April 25, 2026 11:05 View session

Copilot finished work on behalf of pelikhan April 25, 2026 11:05

Copilot AI requested a review from pelikhan April 25, 2026 11:05

Copilot started work on behalf of pelikhan April 25, 2026 11:08 View session

fix: add second blank separator line after threat detection caution a…

39f92b3

…lert Agent-Logs-Url: https://github.com/github/gh-aw/sessions/adab9e29-e34d-4824-93fb-79d65c01e8a1 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 25, 2026 11:12

pelikhan marked this pull request as ready for review April 25, 2026 11:15

Copilot AI review requested due to automatic review settings April 25, 2026 11:15

Copilot started reviewing on behalf of pelikhan April 25, 2026 11:16 View session

github-actions Bot mentioned this pull request Apr 25, 2026

[aw] No-Op Runs #28177

Closed

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 25, 2026 11:25 View session

test: add threat detection caution tests and fix duplicate JSDoc in m…

2000285

…essages_footer Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f36dc55f-6578-4446-b624-09990dcd9eca Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 25, 2026 11:34

pelikhan merged commit d57a99d into main Apr 25, 2026

pelikhan deleted the copilot/change-rendering-order-pr-body branch April 25, 2026 11:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: place threat detection CAUTION alert at top of PR body and add agentic-threat-detected label#28429

feat: place threat detection CAUTION alert at top of PR body and add agentic-threat-detected label#28429
pelikhan merged 4 commits intomainfrom
copilot/change-rendering-order-pr-body

Copilot AI commented Apr 25, 2026 •

edited

Loading

Uh oh!

pelikhan commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 25, 2026

Uh oh!

Copilot AI Apr 25, 2026

Uh oh!

Copilot AI Apr 25, 2026

Uh oh!

pelikhan commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

actions/setup/js/messages_footer.cjs

actions/setup/js/create_pull_request.cjs

actions/setup/js/create_pull_request.test.cjs

Before / After

Testing

Uh oh!

pelikhan commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Apr 25, 2026

Uh oh!

Copilot AI commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 25, 2026 •

edited

Loading

`actions/setup/js/messages_footer.cjs`

`actions/setup/js/create_pull_request.cjs`

`actions/setup/js/create_pull_request.test.cjs`