Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/78a3a14b-2c72-4757-b59a-c220e7ebc39a Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…blocked commands) Agent-Logs-Url: https://github.com/github/gh-aw/sessions/78a3a14b-2c72-4757-b59a-c220e7ebc39a Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix failures in claude engine runs
fix: resolve 3 claude-engine workflow failures (safe-output misses + blocked commands)
May 4, 2026
pelikhan
approved these changes
May 4, 2026
Contributor
|
Hey One thing that would strengthen this PR:
If you'd like a hand, you can assign this prompt to your coding agent:
|
Collaborator
|
@copilot merge main and recompile |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aims to prevent three Claude-based GitHub Actions workflows from exiting without producing any safe-output by fixing GitHub tool access mode mismatches and overly-restrictive bash allowlists, then recompiling the affected .lock.yml workflows.
Changes:
- Switches Schema Consistency Checker GitHub access from
remotetogh-proxyand updates the compiled workflow to use the CLI proxy path. - Broadens blocked bash command patterns (notably
yqandplaywright-cli) to match the commands the workflows instruct the agent to run. - Updates action pin data with additional major-tag entries to support compilation/pinning.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/data/action_pins.json |
Adds major-tag pins (e.g., actions/checkout@v4, actions/setup-python@v5) used during workflow compilation/pinning. |
pkg/actionpins/data/action_pins.json |
Mirrors the same action pin additions for the actionpins package dataset. |
.github/workflows/step-name-alignment.md |
Relaxes yq bash restrictions and fixes the documented cache-memory path. |
.github/workflows/step-name-alignment.lock.yml |
Recompiled lock workflow reflecting the updated yq allowlist and prompt/cache changes. |
.github/workflows/schema-consistency-checker.md |
Switches GitHub tool mode from remote to gh-proxy. |
.github/workflows/schema-consistency-checker.lock.yml |
Recompiled lock workflow to use CLI proxy approach and updated prompts/network config. |
.github/workflows/daily-multi-device-docs-tester.md |
Allows playwright-cli* to match the documented Playwright usage. |
.github/workflows/daily-multi-device-docs-tester.lock.yml |
Recompiled lock workflow reflecting the updated bash allowlist. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 8/8 changed files
- Comments generated: 2
| run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh" | ||
| - name: Start CLI Proxy | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} |
| env: | ||
| GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} | ||
| GITHUB_SERVER_URL: ${{ github.server_url }} | ||
| CLI_PROXY_POLICY: '{"allow-only":{"repos":"all","min-integrity":"none"}}' |
…ix-claude-engine-runs # Conflicts: # .github/workflows/daily-multi-device-docs-tester.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in a292bc2. Merged origin/main, resolved the conflict in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three Claude-engine workflows in the 2026-05-04 6h failure report all exited without calling any safe-output tool, caused by broken GitHub tool access, missing bash permissions, and overly-restrictive command patterns.
Changes
Schema Consistency Checker —
github.mode: remote→gh-proxy.remotemode requires a PAT and silently fails withGITHUB_TOKEN, causing GitHub tool calls to error out; the agent exhausted its 60-turn limit without ever reachingcreate-discussionornoop.Multi-Device Docs Tester — Relies on the compiler's auto-injection of
Bash(playwright-cli:*)whenplaywright.mode: cliis configured (introduced in feat: auto-allow playwright-cli bash command when playwright cli mode is enabled #30126). No manual bash restriction change needed in the source; the compiler now handles it automatically.Step Name Alignment — Two fixes:
"yq eval '.jobs.*.steps[].name' .github/workflows/*.lock.yml"to"yq*". The specific pattern blocked single-file queries and loop constructs the agent naturally reaches for./tmp/gh-aw/cache-memory/step-name-alignment/patterns.json(subdirectory) to/tmp/gh-aw/cache-memory/step-name-alignment.json(flat). The compiled--allowed-toolsusesEdit(/tmp/gh-aw/cache-memory/*)— a single-level glob that does not match subdirectory paths.All three
.lock.ymlfiles recompiled after merging main.