Stabilize Daily Model Inventory Copilot startup by removing fragile quoted jq allow-tool

[Copilot]

Daily Model Inventory Checker intermittently failed before agent execution: Copilot exited immediately with exitCode=1 and no stderr/stdout. The failing run included a quoted jq-filter shell(...) allow-tool argument in the generated Copilot command line.

• Root-cause mitigation in workflow tool allow-list

  • Removed the high-risk quoted jq-filter allow-tool entry from daily-model-inventory.md.
  • Kept existing access to reflect.json via safer, simpler allowed commands already present (jq . /tmp/gh-aw/model-inventory/reflect.json, cat, etc.).

• Compiled workflow alignment

  • Updated daily-model-inventory.lock.yml so the generated Copilot invocation no longer includes:
    • --allow-tool 'shell(jq ".endpoints[] | select(.provider == \"copilot\") | .models" /tmp/gh-aw/model-inventory/reflect.json)'

• Regression guard

  • Extended pkg/workflow/daily_model_inventory_workflow_test.go with an assertion that this quoted jq allow-tool pattern is absent from the compiled lock workflow.

# removed from tool allow-list generation
- "jq \".endpoints[] | select(.provider == \\\"copilot\\\") | .models\" /tmp/gh-aw/model-inventory/reflect.json"

[pelikhan]

@copilot allow bash *

[Copilot]

Pull request overview

Stabilizes the “Daily Model Inventory Checker” Copilot startup by removing a fragile, heavily-escaped jq allow-tool entry that intermittently caused the Copilot CLI to exit early.

Changes:

• Replaces the workflow’s tools.bash allowlist with a wildcard ("*"), resulting in --allow-all-tools in the compiled Copilot invocation.
• Updates the compiled lock workflow to remove the previously generated quoted jq --allow-tool shell(...) entry.
• Extends the Go workflow compilation test to assert --allow-all-tools is present and that the quoted jq allow-tool pattern is absent.

Show a summary per file

File	Description
pkg/workflow/daily_model_inventory_workflow_test.go	Adds regression assertions around compiled workflow tool flags/patterns.
.github/workflows/daily-model-inventory.md	Changes bash tool configuration to wildcard, impacting compiled Copilot permissions.
.github/workflows/daily-model-inventory.lock.yml	Reflects the recompiled Copilot invocation without the quoted jq allow-tool entry.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1