Add version tag comments to pinned GitHub Actions by Copilot · Pull Request #3848 · github/gh-aw

Copilot · 2025-11-13T11:29:00Z

Completed: Fix Action Pin Comments and Merge Main

Merge main branch
Fix unquoteUsesWithComments function logic
Apply unquoteUsesWithComments to CustomSteps processing
Apply unquoteUsesWithComments to PostSteps processing
Add comprehensive tests for unquoteUsesWithComments
Run linting and tests
Verify all quoted uses are removed

Issue Analysis

The bot review identified that many uses: values were still quoted despite the unquoteUsesWithComments function. Investigation revealed:

Root Cause: Custom steps and post-steps defined in workflow frontmatter bypass ConvertStepToYAML - they're marshalled directly to YAML strings without post-processing
Missing Calls: The unquoteUsesWithComments function wasn't being called after marshalling CustomSteps and PostSteps

Changes Made

Modified Files:

pkg/workflow/compiler.go - Added 4 calls to unquoteUsesWithComments:
- Line 1038: After marshalling merged custom steps
- Line 1048: After marshalling imported steps
- Line 1065: After marshalling main custom steps
- Line 1090: After marshalling post-steps
pkg/workflow/agentic_engine.go - Improved unquoteUsesWithComments function for robustness
pkg/workflow/unquote_uses_test.go - Added comprehensive test coverage:
- Basic functionality (12 tests): quoted/unquoted uses, indentation, multiple lines, empty strings, version tags
- Edge cases (6 tests): malformed input, hash in action names, multiple quotes, spacing variations
- Real world examples (2 tests): actual workflows from unbloat-docs and post-steps

Results

✅ All 78 workflows compiled successfully
✅ All unit tests passing (20 new tests added)
✅ Zero quoted uses values remain (previously 34)
✅ Version comments properly preserved

Before:

uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5"

After:

uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5

Original prompt

The action pin updater should add a comment with the tag when replacing a tag with a sha

Unpinned:

uses: slug@tag

Pinned:

uses: slug@sha # tag

Update generated code to include the sha comment

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Modified GetActionPin and GetActionPinWithData to append version comments - Added unquoteUsesWithComments function to handle YAML marshalling quotes - Updated tests to expect new format with version comments - All pinned actions now show format: uses: slug@sha # version Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-11-13T11:49:45Z

@copilot merge main and lint

Copilot

Pull Request Overview

This PR adds version tag comments to pinned GitHub Actions to improve readability and maintainability. When actions are pinned to SHA commits for security, a comment is added showing the original version tag (e.g., uses: actions/checkout@sha # v5).

Key Changes

Modified GetActionPin() and GetActionPinWithData() to append version comments to SHA references
Added unquoteUsesWithComments() function to handle YAML marshaller's quoting behavior
Updated tests to expect the new comment format

Reviewed Changes

Copilot reviewed 68 out of 80 changed files in this pull request and generated 5 comments.

File	Description
pkg/workflow/action_pins.go	Modified pin functions to append `# <version>` comments to action SHAs
pkg/workflow/agentic_engine.go	Added post-processing to remove quotes from `uses` values with comments
pkg/workflow/action_pins_test.go	Updated test expectations to include version comments in assertions
.github/workflows/*.lock.yml	Regenerated workflow files with new pinned action format including version comments

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-13T11:52:46Z

@@ -935,11 +935,11 @@ jobs:
      output_types: ${{ steps.collect_output.outputs.output_types }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5"


This uses value is quoted, which is inconsistent with other action pins. The unquoting function should have removed these quotes to match the format of other pinned actions in the workflow files.

Copilot · 2025-11-13T11:52:46Z

+				parts := strings.SplitN(line, "\"", 3)
+				if len(parts) >= 3 {
+					// parts[0] = "  uses: " OR "  - uses: "
+					// parts[1] = "slug@sha # version"
+					// parts[2] = "" or something else
+					lines[i] = parts[0] + parts[1] + strings.TrimPrefix(parts[2], "\"")


The unquoteUsesWithComments function has a logic issue with how it handles quotes. When splitting by ", if there are multiple quoted sections on a line or if the comment itself contains quotes, this could produce incorrect output. The function splits by " expecting exactly 3 parts, but doesn't validate this assumption properly.

Additionally, the check if len(parts) >= 3 allows for cases with more than 3 parts (4+), which could happen if there are additional quotes in the line. This would incorrectly concatenate parts and potentially break the YAML syntax.

Copilot · 2025-11-13T11:52:46Z

+					// parts[0] = "  uses: " OR "  - uses: "
+					// parts[1] = "slug@sha # version"
+					// parts[2] = "" or something else
+					lines[i] = parts[0] + parts[1] + strings.TrimPrefix(parts[2], "\"")


The strings.TrimPrefix(parts[2], "\"") only removes a leading quote from parts[2]. However, if the original line was uses: "slug@sha # v1", after splitting by ", parts[2] would be an empty string (or subsequent content), not a string with a leading quote to trim. This logic doesn't correctly handle the closing quote of the quoted uses value.

For a line like uses: "actions/checkout@sha # v5", splitting by " gives:

parts[0] = "uses: "

parts[1] = "actions/checkout@sha # v5"

parts[2] = "" (empty)

The TrimPrefix on an empty string is a no-op, which works by accident, but the logic is confusing and fragile.

Copilot · 2025-11-13T11:52:47Z

@@ -167,15 +167,15 @@ jobs:
        run: "pip install --user numpy pandas matplotlib seaborn scipy\n\n# Verify installations\npython3 -c \"import numpy; print(f'NumPy {numpy.__version__} installed')\"\npython3 -c \"import pandas; print(f'Pandas {pandas.__version__} installed')\"\npython3 -c \"import matplotlib; print(f'Matplotlib {matplotlib.__version__} installed')\"\npython3 -c \"import seaborn; print(f'Seaborn {seaborn.__version__} installed')\"\npython3 -c \"import scipy; print(f'SciPy {scipy.__version__} installed')\"\n\necho \"All scientific libraries installed successfully\"\n"
      - if: always()
        name: Upload generated charts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+        uses: "actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5"


This uses value is quoted, which is inconsistent with other action pins in the same file. All other pinned actions in this workflow use unquoted format (e.g., line 66, 74), but this one is quoted. This suggests the unquoteUsesWithComments function may not be working correctly for all cases, or these specific instances weren't processed through the same code path.

Copilot · 2025-11-13T11:52:47Z

        with:
          if-no-files-found: warn
          name: data-charts
          path: /tmp/gh-aw/python/charts/*.png
          retention-days: 30
      - if: always()
        name: Upload source files and data
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+        uses: "actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5"


This uses value is quoted, which is inconsistent with other action pins in the same file. Most other pinned actions use unquoted format, but this one is quoted. This inconsistency suggests the unquoteUsesWithComments function may not be processing all action references uniformly.

pelikhan · 2025-11-13T11:55:30Z

@copilot review the unquoting bugs and add tests

…placement-comment

- Fixed function to properly process CustomSteps after YAML marshalling - Added unquoteUsesWithComments call for CustomSteps in all 3 code paths - Added unquoteUsesWithComments call for PostSteps - Improved function logic for better reliability - Merged main branch successfully - All tests passing - Zero quoted uses values remaining in compiled workflows Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-11-13T12:45:15Z

@copilot merge main and lint

Merged main and fixed all linting issues in commit fc60a6b. All workflows now compile cleanly with unquoted action pins including version comments.

- Created unquote_uses_test.go with 3 test suites - TestUnquoteUsesWithComments: 12 basic test cases - TestUnquoteUsesWithCommentsEdgeCases: 6 edge case tests - TestUnquoteUsesWithCommentsRealWorldExamples: 2 real workflow tests - All 20 tests pass - Tests cover normal cases, edge cases, malformed input, and real workflows - Validates the function correctly handles quotes with version comments Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-11-13T12:53:53Z

@copilot review the unquoting bugs and add tests

Added comprehensive tests in commit 785311b. Created 3 test suites with 20 tests total:

Basic functionality (12 tests): quoted/unquoted uses, indentation, multiple lines, empty strings, version tags
Edge cases (6 tests): malformed input, hash in action names, multiple quotes, spacing variations
Real world examples (2 tests): actual workflows from unbloat-docs and post-steps

All tests pass. The unquoteUsesWithComments function is now fully tested and validates that it correctly handles:

Quoted uses with version comments → unquoted with comments preserved
Unquoted uses → no modification
Quoted uses without comments → no modification
Malformed input → gracefully skipped

Initial plan

f0e92bc

Copilot AI assigned Copilot and pelikhan Nov 13, 2025

Copilot started work on behalf of pelikhan November 13, 2025 11:29 View session

Copilot AI and others added 2 commits November 13, 2025 11:34

Initial exploration - identified action pin updater location

a0f7a79

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan approved these changes Nov 13, 2025

View reviewed changes

pelikhan marked this pull request as ready for review November 13, 2025 11:49

Copilot AI review requested due to automatic review settings November 13, 2025 11:49

Copilot started reviewing on behalf of pelikhan November 13, 2025 11:50 View session

Copilot finished reviewing on behalf of pelikhan November 13, 2025 11:51

Copilot AI changed the title ~~[WIP] Add comment with tag when replacing tag with sha~~ Add version tag comments to pinned GitHub Actions Nov 13, 2025

Copilot AI reviewed Nov 13, 2025

View reviewed changes

Copilot AI requested a review from pelikhan November 13, 2025 11:52

Copilot finished work on behalf of pelikhan November 13, 2025 11:52

Copilot started work on behalf of pelikhan November 13, 2025 11:53 View session

Copilot AI and others added 2 commits November 13, 2025 12:01

Merge remote-tracking branch 'origin/main' into copilot/update-tag-re…

3c1dcde

…placement-comment

Copilot finished work on behalf of pelikhan November 13, 2025 12:46

Copilot started work on behalf of pelikhan November 13, 2025 12:47 View session

Copilot finished work on behalf of pelikhan November 13, 2025 12:56

pelikhan merged commit d0bad47 into main Nov 13, 2025
75 of 81 checks passed

pelikhan deleted the copilot/update-tag-replacement-comment branch November 13, 2025 14:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add version tag comments to pinned GitHub Actions#3848

Add version tag comments to pinned GitHub Actions#3848
pelikhan merged 6 commits into
mainfrom
copilot/update-tag-replacement-comment

Copilot AI commented Nov 13, 2025 •

edited

Loading

Uh oh!

pelikhan commented Nov 13, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 13, 2025

Uh oh!

Copilot AI Nov 13, 2025

Uh oh!

Copilot AI Nov 13, 2025

Uh oh!

Copilot AI Nov 13, 2025

Uh oh!

Copilot AI Nov 13, 2025

Uh oh!

pelikhan commented Nov 13, 2025

Uh oh!

Copilot AI commented Nov 13, 2025

Uh oh!

Copilot AI commented Nov 13, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Completed: Fix Action Pin Comments and Merge Main

Issue Analysis

Changes Made

Results

Uh oh!

pelikhan commented Nov 13, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Nov 13, 2025

Uh oh!

Copilot AI commented Nov 13, 2025

Uh oh!

Copilot AI commented Nov 13, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Nov 13, 2025 •

edited

Loading