Require detection success before running `update_cache_memory` by Copilot · Pull Request #33885 · github/gh-aw

Copilot · 2026-05-21T22:34:44Z

update_cache_memory was running even when detection was skipped because its condition explicitly allowed skipped. This change tightens cache persistence semantics so cache updates occur only after a successful detection pass.

Workflow semantics
- Changed update_cache_memory gating from (success || skipped) to success for detection.
- Keeps always() in place so the condition is still evaluated predictably across upstream outcomes.
- Retains agent success requirement (needs.agent.result == 'success').
Compiler logic
- Updated cache-memory job condition generation in pkg/workflow/cache.go to use buildDetectionSuccessCondition() instead of buildDetectionPassedCondition() for update_cache_memory.
Generated workflow output
- Recompiled lock workflows so emitted update_cache_memory jobs consistently require detection success.
Expectation/docs alignment
- Updated unit/integration expectations and cache-memory workflow fixture text to reflect the new behavior (no skipped acceptance for update_cache_memory).

update_cache_memory:
  if: >
    always() && needs.detection.result == 'success' &&
    needs.agent.result == 'success'

pr-sous-chef: automated branch update from run https://github.com/github/gh-aw/actions/runs/26259944210

Generated by 👨‍🍳 PR Sous Chef · ● 209.4K · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Tightens cache-memory persistence semantics so the update_cache_memory job only runs after a successful detection job (no longer when detection is skipped).

Changes:

Updated compiler condition generation for update_cache_memory to require needs.detection.result == 'success'.
Updated integration/unit tests and fixtures to assert the new gating behavior (and explicitly reject 'skipped').
Recompiled affected .lock.yml workflows so generated update_cache_memory jobs match the new condition.

Show a summary per file

File	Description
pkg/workflow/cache.go	Switches `update_cache_memory` gating from “passed” (success/skipped) to “success only”.
pkg/workflow/expression_builder.go	Updates documentation for `buildDetectionPassedCondition` usage (no longer mentions `update_cache_memory`).
pkg/workflow/compiler_jobs_test.go	Adjusts job-condition assertions to require detection success and forbid skipped.
pkg/workflow/cache_memory_threat_detection_test.go	Updates compiled-workflow expectations for the new `if:` condition.
pkg/workflow/threat_detection_job_combinations_integration_test.go	Updates integration expectations and adds negative assertion for `'skipped'` in `update_cache_memory`.
pkg/cli/workflows/test-copilot-cache-memory-threat-detection.md	Updates documentation/expectations to require detection success for cache updates.
pkg/cli/workflows/test-copilot-cache-memory-threat-detection-expression.md	Updates documentation/expectations for expression-controlled detection to require success.
.github/workflows/weekly-issue-summary.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/unbloat-docs.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/test-create-pr-error-handling.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/technical-doc-writer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/super-linter.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/step-name-alignment.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/static-analysis-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/stale-repo-identifier.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/spec-extractor.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/spec-enforcer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-pi.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-gemini.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-copilot.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-copilot-arm.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-codex.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/smoke-claude.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/slide-deck-maintainer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/scout.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/schema-consistency-checker.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/safe-output-health.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/repository-quality-improver.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/repo-audit-analyzer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/refactoring-cadence.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/python-data-charts.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/prompt-clustering-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/poem-bot.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/pdf-summary.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/outcome-collector.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/org-health-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/mcp-inspector.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/lockfile-stats.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/linter-miner.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/jsweep.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/instructions-janitor.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/gpclean.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/go-logger.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/go-fan.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/glossary-maintainer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/github-mcp-tools-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/github-mcp-structural-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/firewall-escape.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/developer-docs-consolidator.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/deep-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/dead-code-remover.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-subagent-optimizer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-spdd-spec-planner.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-security-red-team.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-security-observability.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-safe-output-optimizer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-repo-chronicle.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-performance-summary.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-news.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-issues-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-hippo-learn.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-function-namer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-firewall-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-fact.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-experiment-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-doc-updater.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-doc-healer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-compiler-quality.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-code-metrics.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-caveman-optimizer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-cache-strategy-analyzer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-session-insights.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-opt.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/copilot-agent-analysis.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/constraint-solving-potd.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/code-scanning-fixer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/cloclo.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/cli-version-checker.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/claude-code-user-docs-review.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/ci-doctor.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/ci-coach.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/audit-workflows.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/api-consumption-report.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/agent-persona-explorer.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.
.github/workflows/ab-testing-advisor.lock.yml	Regenerates `update_cache_memory` `if:` to require detection success.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 94/94 changed files
Comments generated: 0

pelikhan · 2026-05-21T23:44:44Z

@copilot merge main and recompile

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-21T23:56:09Z

@copilot merge main and recompile

Done in a9b298c — merged main into this branch and recompiled workflows.

Document the threat detection rule implemented in PR #33885 that requires detection success before running update_cache_memory jobs. Changes: - Bumped spec version to 1.0.10 - Added CTR-019 to Section 5.1 core rule catalog - Added implementation mapping in Section 7.1 - Added T-CTR-019 test ID in Section 8.1 - Updated mapping audit timestamp in Section 7.2 - Added change log entry for version 1.0.10 The rule enforces cache-memory integrity by preventing cache updates when threat detection has been skipped or failed, ensuring only validated agent outputs are persisted to cache-memory. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI and others added 3 commits May 21, 2026 22:28

Require detection success for update_cache_memory

1bc4314

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Recompile lock workflows for detection-success cache gating

03bbf83

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify detection-passed helper comment

4e9b8e8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan May 21, 2026

Copilot AI changed the title ~~Require detection success before update_cache_memory runs~~ Require detection success before running update_cache_memory May 21, 2026

Copilot finished work on behalf of pelikhan May 21, 2026 22:35

Copilot created this pull request from a session on behalf of pelikhan May 21, 2026 22:35 View session

Copilot AI requested a review from pelikhan May 21, 2026 22:35

pelikhan marked this pull request as ready for review May 21, 2026 22:41

Copilot AI review requested due to automatic review settings May 21, 2026 22:41

Copilot started reviewing on behalf of pelikhan May 21, 2026 22:43 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 21, 2026

Smoke Test: Claude - 26257437320 #33891

Closed

Copilot started work on behalf of pelikhan May 21, 2026 23:44 View session

Merge main and recompile workflows

a9b298c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 21, 2026 23:56

github-actions Bot mentioned this pull request May 22, 2026

[aw] No-Op Runs #33835

Open

pelikhan merged commit b9993d3 into main May 22, 2026

pelikhan deleted the copilot/ensure-update-cache-memory-skipped branch May 22, 2026 01:23

github-actions Bot mentioned this pull request May 22, 2026

[compiler-threat-spec] spec: add CTR-019 Cache-Memory Integrity Enforcement #33908

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Require detection success before running `update_cache_memory`#33885

Require detection success before running `update_cache_memory`#33885
pelikhan merged 4 commits into
mainfrom
copilot/ensure-update-cache-memory-skipped

Copilot AI commented May 21, 2026 •

edited by github-actions Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 21, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 21, 2026 •

edited by github-actions Bot

Loading