Fix Copilot driver startup failure by removing runtime minimatch dependency#37373
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
minimatch dependency
| return true; | ||
| } | ||
| return minimatch(normalizedRequestedPath, normalizedPattern, { dot: true }); | ||
| return globPatternToRegex(normalizedPattern).test(normalizedRequestedPath); |
There was a problem hiding this comment.
Updated in 5df00ff: switched the read-path glob check to Node 24 built-in path.posix.matchesGlob(...) and removed the custom runtime glob-to-regex helpers from copilot_sdk_driver.cjs.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR aims to prevent Copilot driver startup failures in compiled workflow execution by eliminating the runtime minimatch require from actions/setup/js/copilot_sdk_driver.cjs, and it updates the allowlist tests to cover recursive (**) read-path behavior. It also adjusts SARIF upload jobs in several locked workflows to explicitly grant actions: read so they can download artifacts before uploading to code scanning.
Changes:
- Replaced runtime
minimatchglob checks incopilot_sdk_driver.cjswith a Node path-based glob matcher. - Extended the SDK driver permission test to cover nested
**read-path behavior. - Added
permissions: actions: readto SARIF upload jobs in multiple locked workflows to support artifact downloads.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/copilot_sdk_driver.cjs | Removes runtime minimatch usage and updates read-path glob matching logic. |
| actions/setup/js/copilot_sdk_driver.test.cjs | Adds coverage for nested ** read-path allowlist behavior. |
| .github/workflows/smoke-claude.lock.yml | Grants actions: read to SARIF upload job so it can download artifacts. |
| .github/workflows/daily-semgrep-scan.lock.yml | Grants actions: read to SARIF upload job so it can download artifacts. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Grants actions: read to SARIF upload job so it can download artifacts. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/5 changed files
- Comments generated: 1
| const normalizedPattern = normalizePermissionPath(pattern); | ||
| if (normalizedRequestedPath === normalizedPattern) { | ||
| return true; | ||
| } | ||
| return minimatch(normalizedRequestedPath, normalizedPattern, { dot: true }); | ||
| return path.posix.matchesGlob(normalizedRequestedPath, normalizedPattern); |
Daily Secrets Analysis failed before producing agent output because
copilot_sdk_driver.cjsrequiredminimatchat runtime in the workflow temp environment, where that module was not available. This PR removes that runtime coupling so the Copilot engine can initialize reliably in compiled workflow execution.Root cause
actions/setup/js/copilot_sdk_driver.cjsimportedminimatchfor read-path allowlist checks._temp/gh-aw/actions/...without a resolvableminimatchpackage, causing immediate process termination.Code change
minimatchusage with Node 24 built-in glob matching for permission path evaluation.copilot_sdk_driver.cjs.Test update
actions/setup/js/copilot_sdk_driver.test.cjsread-path allowlist coverage to include nested**behavior, ensuring parity for recursive path patterns.