[ci-coach] Fix test-unit sync failures: fallback AW files list and OTLP WIF script - #50891
Conversation
- Add missing designer-mappings.md to fallback AW files list - Sync SEC-004 safe-outputs-exempt comment into pkg/workflow/js copy of exchange_otlp_workload_identity.cjs to match actions/setup/js copy Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Threat detection produced a warning for this pull request output.
These changes need to be scrutinized before merge and only merged after a careful manual review.
- Detection reason:
agent_failure - Review workflow run logs: https://github.com/github/gh-aw/actions/runs/31107125546
|
✅ Test Quality Sentinel completed test quality analysis. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. No test files were added or modified in this PR. Test Quality Sentinel skipped. |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. No ADR enforcement needed: PR #50891 does not have the 'implementation' label and has only 2 new lines of code in business logic directories (threshold: 100). |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. |
There was a problem hiding this comment.
Pull request overview
Synchronizes generated and mirrored files to restore unit-test consistency.
Changes:
- Adds
designer-mappings.mdto the offline fallback file list. - Synchronizes the OTLP WIF script’s safe-output exemption comment.
Show a summary per file
| File | Description |
|---|---|
pkg/cli/data/agentic_workflows_fallback_aw_files.json |
Adds the missing AW document entry. |
pkg/workflow/js/exchange_otlp_workload_identity.cjs |
Matches the canonical setup script. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Balanced
|
✅ PR Code Quality Reviewer completed the code quality review. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. |
There was a problem hiding this comment.
Warning
Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Skills-Based Review 🧠
Applied /diagnosing-bugs — both fixes are exact, minimal sync corrections with no logic changes.
📋 Summary
Changes
pkg/cli/data/agentic_workflows_fallback_aw_files.json: adds"designer-mappings.md"to keep the offline fallback list in sync with.github/aw/.pkg/workflow/js/exchange_otlp_workload_identity.cjs: backports the@safe-outputs-exempt SEC-004comment so both copies remain byte-identical.
Assessment
- ✅ Root causes correctly identified (file drift, not logic bugs)
- ✅ Both fixes are the minimal, unambiguous change required
- ✅ No additional regression tests needed — the existing sync tests serve as regression guards
- ✅ No behavioral or functional change
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 16.4 AIC · ⊞ 7.1K
Comment /matt to run again
There was a problem hiding this comment.
Warning
Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Both sync fixes are correct and verified:
designer-mappings.mdexists in.github/aw/and is now listed in the fallback JSON in correct alphabetical order.- The two
.cjscopies are byte-identical after adding the@safe-outputs-exemptcomment.
No logic or behavioral changes. ✅
🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.9 AIC · ⊞ 5.4K
|
Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. 🧪 Test Quality Sentinel ReportStatus: ✅ No test files to analyze This PR modifies only non-test files:
No test files (Go No further test quality review required.
|
There was a problem hiding this comment.
Warning
Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Verdict: Approve
Trivial, correct sync fix — no blocking issues.
Details
Both changes verified independently:
- The added
"designer-mappings.md"entry to the fallback JSON matches the actual file count in.github/aw/*.md(67 entries in both). - The
.cjsfiles inpkg/workflow/js/andactions/setup/js/are now byte-identical (verified withdiff).
Both are additive, no-behavior-change fixes addressing generated/mirrored file drift caught by unit tests. No correctness, performance, or security concerns in this diff.
🔎 Code quality review by PR Code Quality Reviewer · auto · 13.4 AIC · ⊞ 7.8K
Comment /review to run again
|
🎉 This pull request is included in a new release. Release: |
Warning
Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.
What happened
The threat detection engine failed to produce results.
Review the workflow run logs for details.
CI Optimization Proposal (Pre-flight Repair)
Summary
Pre-flight validation for this run showed
test-unitfailing (exit 1) whiledeps-dev,lint,lint-errors,npm-ci,build, andrecompileall passed. Two unit tests failed because generated/mirrored files were out of sync with their sources. This PR fixes both by syncing the affected files.Root Cause & Fix
1.
TestFallbackAWFilesMatchesLocalAWDirectory(pkg/cli)test-unitentirely"designer-mappings.md"entry topkg/cli/data/agentic_workflows_fallback_aw_files.json, matching current.github/aw/*.mdcontents. The test itself auto-updates this file when the discrepancy is detected; the auto-generated diff was applied.designer-mappings.md) was added to.github/aw/without regenerating the fallback JSON snapshot used when the CLI cannot access the network. Keeping this file in sync ensures offline CLI users get the correct workflow file listing.2.
TestExchangeOTLPWorkloadIdentityScriptInSync(pkg/workflow)//@safe-outputs-exemptSEC-004 ...comment line topkg/workflow/js/exchange_otlp_workload_identity.cjsso it exactly matchesactions/setup/js/exchange_otlp_workload_identity.cjs(the two copies must be byte-identical per the test).actions/setup/jscopy but not backported to thepkg/workflow/jscopy.Expected Impact
test-unitstep in CI (currently failing on every run for these two tests)Validation Results
Sandbox network access to proxy.golang.org was blocked (403 Forbidden via the sandbox egress proxy), so
go test/make test-unitcould not be re-run locally in this environment. Both fixes were derived directly from the exact expected-vs-actual diffs captured in the pre-flighttest-results.jsonfailure output, and are minimal (1-line additions each) with no ambiguity in what change is required:diff, no output).Metrics Baseline
test-unitexit_code=1 (2 failing tests) before this change; all other steps (deps-dev,lint,lint-errors,npm-ci,build,recompile) passed.Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.orgTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.