fix: move poutine:ignore suppression comments inside run: script bodies

[Copilot]

Poutine's untrusted_checkout_exec rule was still firing on 10 already-reviewed steps across smoke-workflow-call.lock.yml and smoke-workflow-call-with-inputs.lock.yml because the # poutine:ignore annotation landed between env: and run: in the YAML mapping — a position some parsers attribute to the preceding env: block rather than the run: key.

Changes

• 5 compiler source locations (pr.go, ambient_folders.go ×2, compiler_yaml_prompt.go, unified_prompt_step.go): move # poutine:ignore untrusted_checkout_exec from a YAML-level comment above run: into the first line of the script body, which poutine unambiguously associates with the step's execution.
• 276 .lock.yml files and wasm golden test files regenerated.

Before (comment between YAML keys — ambiguous attribution):

        env:
          GH_AW_AGENT_FILES: "AGENTS.md"
        # poutine:ignore untrusted_checkout_exec
        run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"

After (comment inside script body — unambiguous):

        env:
          GH_AW_AGENT_FILES: "AGENTS.md"
        run: |
          # poutine:ignore untrusted_checkout_exec
          bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"

• Fixes [static-analysis] Report - 2026-08-06 #50789

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR standardizes where # poutine:ignore untrusted_checkout_exec appears in generated GitHub Actions YAML by moving it into run: | script blocks and updating the Go workflow compiler/generators accordingly.

Changes:

• Update Go workflow generation helpers to emit run: | blocks and place # poutine:ignore untrusted_checkout_exec inside the script.
• Regenerate multiple workflow .lock.yml files to reflect the new run: | format and comment placement.

Show a summary per file

File	Description
pkg/workflow/unified_prompt_step.go	Move poutine ignore marker into the generated `run:
pkg/workflow/pr.go	Emit `run:
pkg/workflow/compiler_yaml_prompt.go	Emit `run:
pkg/workflow/ambient_folders.go	Move ignore marker into `run:
.github/workflows/workflow-skill-extractor.lock.yml	Regenerated to use `run:
.github/workflows/workflow-normalizer.lock.yml	Regenerated to use `run:
.github/workflows/workflow-health-manager.lock.yml	Regenerated to use `run:
.github/workflows/workflow-generator.lock.yml	Regenerated to use `run:
.github/workflows/weekly-issue-summary.lock.yml	Regenerated to use `run:
.github/workflows/weekly-editors-health-check.lock.yml	Regenerated to use `run:
.github/workflows/weekly-blog-post-writer.lock.yml	Regenerated to use `run:
.github/workflows/video-analyzer.lock.yml	Regenerated to use `run:
.github/workflows/update-astro.lock.yml	Regenerated to use `run:
.github/workflows/unbloat-docs.lock.yml	Regenerated to use `run:
.github/workflows/ubuntu-image-analyzer.lock.yml	Regenerated to use `run:
.github/workflows/typist.lock.yml	Regenerated to use `run:
.github/workflows/tidy.lock.yml	Regenerated to use `run:
.github/workflows/test-quality-sentinel.lock.yml	Regenerated to use `run:
.github/workflows/terminal-stylist.lock.yml	Regenerated to use `run:
.github/workflows/technical-doc-writer.lock.yml	Regenerated to use `run:
.github/workflows/super-linter.lock.yml	Regenerated to use `run:
.github/workflows/sub-issue-closer.lock.yml	Regenerated to use `run:
.github/workflows/static-analysis-report.lock.yml	Regenerated to use `run:
.github/workflows/stale-repo-identifier.lock.yml	Regenerated to use `run:
.github/workflows/stale-pr-cleanup.lock.yml	Regenerated to use `run:
.github/workflows/spec-librarian.lock.yml	Regenerated to use `run:
.github/workflows/spec-extractor.lock.yml	Regenerated to use `run:
.github/workflows/spec-enforcer.lock.yml	Regenerated to use `run:
.github/workflows/smoke-project.lock.yml	Regenerated to use `run:
.github/workflows/smoke-ci.lock.yml	Regenerated to use `run:
.github/workflows/sighthound-security-scan.lock.yml	Regenerated to use `run:
.github/workflows/sergo.lock.yml	Regenerated to use `run:
.github/workflows/security-review.lock.yml	Regenerated to use `run:
.github/workflows/security-compliance.lock.yml	Regenerated to use `run:
.github/workflows/scout.lock.yml	Regenerated to use `run:
.github/workflows/schema-feature-coverage.lock.yml	Regenerated to use `run:
.github/workflows/schema-consistency-checker.lock.yml	Regenerated to use `run:
.github/workflows/safe-output-health.lock.yml	Regenerated to use `run:
.github/workflows/research.lock.yml	Regenerated to use `run:
.github/workflows/repository-quality-improver.lock.yml	Regenerated to use `run:
.github/workflows/repo-tree-map.lock.yml	Regenerated to use `run:
.github/workflows/release.lock.yml	Regenerated to use `run:
.github/workflows/refiner.lock.yml	Regenerated to use `run:
.github/workflows/refactoring-cadence.lock.yml	Regenerated to use `run:
.github/workflows/q.lock.yml	Regenerated to use `run:
.github/workflows/python-data-charts.lock.yml	Regenerated to use `run:
.github/workflows/pr-triage-agent.lock.yml	Regenerated to use `run:
.github/workflows/pr-description-caveman.lock.yml	Regenerated to use `run:
.github/workflows/plan.lock.yml	Regenerated to use `run:
.github/workflows/pdf-summary.lock.yml	Regenerated to use `run:
.github/workflows/outcome-collector.lock.yml	Regenerated to use `run:
.github/workflows/org-health-report.lock.yml	Regenerated to use `run:
.github/workflows/objective-impact-report.lock.yml	Regenerated to use `run:
.github/workflows/notion-issue-summary.lock.yml	Regenerated to use `run:
.github/workflows/necromancer.lock.yml	Regenerated to use `run:
.github/workflows/metrics-collector.lock.yml	Regenerated to use `run:
.github/workflows/mergefest.lock.yml	Regenerated to use `run:
.github/workflows/mcp-inspector.lock.yml	Regenerated to use `run:
.github/workflows/linter-miner.lock.yml	Regenerated to use `run:
.github/workflows/lint-monster.lock.yml	Regenerated to use `run:
.github/workflows/layout-spec-maintainer.lock.yml	Regenerated to use `run:
.github/workflows/jsweep.lock.yml	Regenerated to use `run:
.github/workflows/issue-triage-agent.lock.yml	Regenerated to use `run:
.github/workflows/issue-arborist.lock.yml	Regenerated to use `run:
.github/workflows/gpclean.lock.yml	Regenerated to use `run:
.github/workflows/go-pattern-detector.lock.yml	Regenerated to use `run:
.github/workflows/go-logger.lock.yml	Regenerated to use `run:
.github/workflows/go-fan.lock.yml	Regenerated to use `run:
.github/workflows/glossary-maintainer.lock.yml	Regenerated to use `run:
.github/workflows/functional-pragmatist.lock.yml	Regenerated to use `run:
.github/workflows/firewall.lock.yml	Regenerated to use `run:
.github/workflows/firewall-escape.lock.yml	Regenerated to use `run:
.github/workflows/example-permissions-warning.lock.yml	Regenerated to use `run:
.github/workflows/example-failure-category-filter.lock.yml	Regenerated to use `run:
.github/workflows/evoskill-evolver.lock.yml	Regenerated to use `run:
.github/workflows/eslint-refiner.lock.yml	Regenerated to use `run:
.github/workflows/eslint-monster.lock.yml	Regenerated to use `run:
.github/workflows/eslint-miner.lock.yml	Regenerated to use `run:
.github/workflows/duplicate-code-detector.lock.yml	Regenerated to use `run:
.github/workflows/draft-pr-cleanup.lock.yml	Regenerated to use `run:
.github/workflows/docs-noob-tester.lock.yml	Regenerated to use `run:
.github/workflows/discussion-task-miner.lock.yml	Regenerated to use `run:
.github/workflows/dictation-prompt.lock.yml	Regenerated to use `run:
.github/workflows/dev.lock.yml	Regenerated to use `run:
.github/workflows/dev-hawk.lock.yml	Regenerated to use `run:
.github/workflows/detection-analysis-report.lock.yml	Regenerated to use `run:
.github/workflows/deployment-incident-monitor.lock.yml	Regenerated to use `run:
.github/workflows/dependabot-go-checker.lock.yml	Regenerated to use `run:
.github/workflows/delight.lock.yml	Regenerated to use `run:
.github/workflows/deep-report.lock.yml	Regenerated to use `run:
.github/workflows/dead-code-remover.lock.yml	Regenerated to use `run:
.github/workflows/daily-team-status.lock.yml	Regenerated to use `run:
.github/workflows/daily-sentrux-report.lock.yml	Regenerated to use `run:
.github/workflows/daily-security-observability.lock.yml	Regenerated to use `run:
.github/workflows/daily-secrets-analysis.lock.yml	Regenerated to use `run:
.github/workflows/daily-regulatory.lock.yml	Regenerated to use `run:
.github/workflows/daily-performance-summary.lock.yml	Regenerated to use `run:
.github/workflows/daily-news.lock.yml	Regenerated to use `run:
.github/workflows/daily-model-resolution.lock.yml	Regenerated to use `run:
.github/workflows/daily-model-inventory.lock.yml	Regenerated to use `run:
.github/workflows/daily-issues-report.lock.yml	Regenerated to use `run:
.github/workflows/daily-geo-optimizer.lock.yml	Regenerated to use `run:
.github/workflows/daily-firewall-report.lock.yml	Regenerated to use `run:
.github/workflows/daily-file-diet.lock.yml	Regenerated to use `run:
.github/workflows/daily-fact.lock.yml	Regenerated to use `run:
.github/workflows/daily-experiment-report.lock.yml	Regenerated to use `run:
.github/workflows/daily-evals-report.lock.yml	Regenerated to use `run:
.github/workflows/daily-credit-limit-test.lock.yml	Regenerated to use `run:
.github/workflows/daily-compiler-quality.lock.yml	Regenerated to use `run:
.github/workflows/daily-community-attribution.lock.yml	Regenerated to use `run:
.github/workflows/daily-cli-tools-tester.lock.yml	Regenerated to use `run:
.github/workflows/daily-cli-performance.lock.yml	Regenerated to use `run:
.github/workflows/daily-choice-test.lock.yml	Regenerated to use `run:
.github/workflows/craft.lock.yml	Regenerated to use `run:
.github/workflows/copilot-session-insights.lock.yml	Regenerated to use `run:
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerated to use `run:
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Regenerated to use `run:
.github/workflows/copilot-opt.lock.yml	Regenerated to use `run:
.github/workflows/copilot-centralization-optimizer.lock.yml	Regenerated to use `run:
.github/workflows/copilot-agent-analysis.lock.yml	Regenerated to use `run:
.github/workflows/contribution-check.lock.yml	Regenerated to use `run:
.github/workflows/constraint-solving-potd.lock.yml	Regenerated to use `run:
.github/workflows/code-simplifier.lock.yml	Regenerated to use `run:
.github/workflows/code-scanning-fixer.lock.yml	Regenerated to use `run:
.github/workflows/ci-doctor.lock.yml	Regenerated to use `run:
.github/workflows/ci-coach.lock.yml	Regenerated to use `run:
.github/workflows/changeset.lock.yml	Regenerated to use `run:
.github/workflows/blog-auditor.lock.yml	Regenerated to use `run:
.github/workflows/audit-workflows.lock.yml	Regenerated to use `run:
.github/workflows/artifacts-summary.lock.yml	Regenerated to use `run:
.github/workflows/architecture-guardian.lock.yml	Regenerated to use `run:
.github/workflows/archie.lock.yml	Regenerated to use `run:
.github/workflows/api-consumption-report.lock.yml	Regenerated to use `run:
.github/workflows/ai-moderator.lock.yml	Regenerated to use `run:
.github/workflows/agentic-token-optimizer.lock.yml	Regenerated to use `run:
.github/workflows/agentic-token-audit.lock.yml	Regenerated to use `run:
.github/workflows/agent-performance-analyzer.lock.yml	Regenerated to use `run:
.github/workflows/ace-editor.lock.yml	Regenerated to use `run:
.github/workflows/ab-testing-advisor.lock.yml	Regenerated to use `run:

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (1)

pkg/workflow/compiler_yaml_prompt.go:1

• Placing # poutine:ignore ... under run: | makes it part of the shell script content (a shell comment), not a YAML comment. If the poutine tooling expects YAML-level comments to control ignores, this change will stop the ignore from being applied. If YAML-level ignores are required, keep the ignore line at the same indentation level as run: (YAML comment) or update poutine’s ignore detection to explicitly support in-script markers (and consider adding both forms during a transition).

• Files reviewed: 289/289 changed files
• Comments generated: 0
• Review effort level: Lite

[pelikhan]

/matt

[github-actions]

🚀 Agentic Commands has started processing this issue comment

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.0