Add `review-agentic-workflows` skill for security-first workflow review and optimization triage by Copilot · Pull Request #53775 · github/gh-aw

Copilot · 2026-08-18T17:46:42Z

This PR adds a dedicated skill for reviewing agentic workflow changes end-to-end, with explicit focus on catching security regressions and surfacing optimization opportunities from run evidence. It also wires the skill into repository-level skill routing so it is discoverable by intent.

New skill: review-agentic-workflows
- Adds .github/skills/review-agentic-workflows/SKILL.md as a self-contained review playbook.
- Defines a structured review flow: scope changed workflows, compile with strict validation/security tooling, detect weakening changes, and report findings by severity.
Security regression detection hardening
- Encodes concrete suspicious-change classes (permission expansion, integrity downgrades, unpinned actions, relaxed guardrails, widened network/tool access, unsafe prompt/script edits).
- Requires explicit rationale for risk-increasing changes instead of silent acceptance.
Run-history optimization guidance
- Adds optional gh aw audit / gh aw logs analysis when run IDs/history are available.
- Focuses optimization recommendations on measurable signals (token/cost hotspots, retry churn, bottleneck steps, avoidable tool calls, firewall-denial loops).
Skill routing integration
- Updates AGENTS.md to map security-focused agentic workflow review tasks to the new skill.

BASE_REF="${BASE_REF:-origin/main}"
if git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
  git diff --name-only "$BASE_REF...HEAD" -- .github/workflows/
else
  git diff --name-only -- .github/workflows/
fi

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-18T17:49:20Z

+
+Run these checks before reviewing:
+
+```bash


@copilot use the bash script to install the cli

Updated in 435a4c6. The setup now uses bash ./install-gh-aw.sh to install gh aw when it is missing, with fallback handling if the installer script is unavailable.

pelikhan · 2026-08-18T17:49:36Z

+Identify changed workflow sources and generated outputs:
+
+```bash
+BASE_REF="${BASE_REF:-origin/main}"


@copilot move this as a step

Updated in 435a4c6. I moved this into explicit step-based guidance so the scope diff command is now part of a clearly defined review step.

pelikhan · 2026-08-18T17:49:45Z

+
+Run these checks before reviewing:
+
+```bash


@copilot move this as a step

Updated in 435a4c6. The setup section is now explicitly step-based, and the CLI install flow is documented as a concrete step.

pelikhan · 2026-08-18T17:50:02Z

+If `gh aw` extension is unavailable but local binary exists:
+
+```bash
+./gh-aw compile --strict --actionlint --zizmor --poutine --runner-guard --yamllint


@copilot also shellcheck

Updated in 435a4c6. Added --shellcheck to both strict compile commands in the skill guidance.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-18T18:23:27Z

PR Triage

Category: docs
Risk: low
Priority score: 37/100 (impact 12, urgency 10, quality 15)
Recommended action: defer

Draft adding a new review-agentic-workflows skill. Already has 5 reviews. Low risk; undraft to proceed to merge track.

Generated by 🔧 PR Triage Agent · auto · 45 AIC · ⌖ 2.09 AIC · ⊞ 8.3K · ◷

pelikhan · 2026-08-18T19:27:24Z

+
+### Step 0) Verify repository and install CLI when missing
+
+```bash


@copilot extract to bash script in the folder

Implemented in 080c574. I extracted the setup/install logic into .github/skills/review-agentic-workflows/setup.sh and updated SKILL.md Step 0 to call that script.

pelikhan · 2026-08-18T19:27:58Z

+
+### 3) Enforce security best practices
+
+Require and verify:


@copilot add an explicit reference to the agentic workflow skill .md file using a github raw user content url.

Implemented in 2cc4187. Added an explicit GitHub rawusercontent URL reference to .github/skills/agentic-workflows/SKILL.md in .github/skills/review-agentic-workflows/SKILL.md.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-18T20:04:49Z

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash


@copilot do not reimplement setup, use the install-aw.sh file in main.

Updated in 4e6d7d4. .github/skills/review-agentic-workflows/setup.sh now uses the repository root ./install-gh-aw.sh installer instead of reimplementing setup/install flow in the skill script.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-18T20:26:22Z

@copilot remove setup.sh and instead prompt the user to test if gh aw is installed or run the bash scripts steps from the gh-aw repo

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-18T20:42:57Z

@copilot remove setup.sh and instead prompt the user to test if gh aw is installed or run the bash scripts steps from the gh-aw repo

Updated in 5d39ee2. I removed .github/skills/review-agentic-workflows/setup.sh and changed Step 0 in SKILL.md to prompt checking gh aw --help, then instruct running bash ./install-gh-aw.sh from the gh-aw repo when missing before continuing.

Copilot

Pull request overview

Adds a security-first playbook for reviewing agentic workflows and makes it discoverable through repository skill routing.

Changes:

Adds workflow security, validation, and optimization review guidance.
Routes relevant reviews to the new skill.

Show a summary per file

File	Description
`AGENTS.md`	Registers the new review skill.
`.github/skills/review-agentic-workflows/SKILL.md`	Defines the review playbook and commands.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 2/2 changed files
Comments generated: 4
Review effort level: Balanced

+# Review Agentic Workflows
+
+Use this skill when asked to review `.github/workflows/*.md` agentic workflows or their generated `.lock.yml` outputs.
+Reference workflow authoring skill guidance at: https://raw.githubusercontent.com/github/gh-aw/main/.github/skills/agentic-workflows/SKILL.md


+if gh aw --help >/dev/null 2>&1; then
+  echo "gh aw is installed"
+else
+  if [ -f ./install-gh-aw.sh ]; then
+    echo "gh aw is missing. Run the install step before continuing:"
+    echo "  bash ./install-gh-aw.sh"
+    echo "Then verify:"
+    echo "  gh aw --help"
+  else
+    echo "gh aw is missing and ./install-gh-aw.sh is not present in this checkout."
+  fi
+  return 1 2>/dev/null || exit 1
+fi


+BASE_REF="${BASE_REF:-origin/main}"
+if git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
+  git diff --name-only "$BASE_REF...HEAD" -- .github/workflows/
+else
+  git diff --name-only -- .github/workflows/
+fi


+
+```bash
+gh aw audit <run-id-or-url>
+gh aw logs --start-date -14d --workflow-name <workflow-name>


github-actions · 2026-08-18T22:19:47Z

🎉 This pull request is included in a new release.

Release: v0.87.1

Copilot AI and others added 3 commits August 18, 2026 17:43

Add review-agentic-workflows skill

461cd8a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix workflow pathspec in new review skill

2ccd462

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Improve workflow diff scoping in review skill

bfa59e5

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Aug 18, 2026

Copilot AI changed the title ~~Add review-agentic-workflows skill for secure workflow reviews~~ Add review-agentic-workflows skill for security-first workflow review and optimization triage Aug 18, 2026

Copilot finished work on behalf of pelikhan August 18, 2026 17:47

Copilot created this pull request from a session on behalf of pelikhan August 18, 2026 17:47 View session

Copilot AI requested a review from pelikhan August 18, 2026 17:47

pelikhan reviewed Aug 18, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 18, 2026 17:50 View session

Copilot AI and others added 2 commits August 18, 2026 18:04

Refine review skill setup and shellcheck guidance

76988d4

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify missing installer handling in skill setup

435a4c6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 18, 2026 18:07

Copilot AI requested a review from pelikhan August 18, 2026 18:07

github-actions Bot added pr-action:defer pr-agent:copilot pr-priority:medium pr-risk:low pr-type:docs labels Aug 18, 2026

github-actions Bot mentioned this pull request Aug 18, 2026

[PR Triage Report] PR Triage Report — 2026-08-18 (9 PRs) #53784

Closed

pelikhan reviewed Aug 18, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 18, 2026 19:27 View session

pelikhan reviewed Aug 18, 2026

View reviewed changes

Extract review skill setup into dedicated script

080c574

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 18, 2026 19:54

Copilot AI requested a review from pelikhan August 18, 2026 19:54

Copilot started work on behalf of pelikhan August 18, 2026 19:54 View session

Add raw URL reference to agentic-workflows skill

2cc4187

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 18, 2026 20:03

pelikhan reviewed Aug 18, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 18, 2026 20:12 View session

Use root install-gh-aw.sh in review skill setup

4e6d7d4

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 18, 2026 20:21

Copilot AI requested a review from pelikhan August 18, 2026 20:21

Copilot started work on behalf of pelikhan August 18, 2026 20:26 View session

Copilot AI and others added 7 commits August 18, 2026 20:36

Remove review skill setup.sh and inline CLI install guidance

e54b190

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fail fast in review skill when gh aw is missing

6672aba

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Harden install guidance in review skill step zero

7576f59

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Make review skill fail-fast safe for sourced shells

ea5c5e5

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Simplify review skill install fallback to local script

145d35e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Improve missing installer guidance in review skill

3f29fe1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify manual install step in review skill setup check

5d39ee2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 18, 2026 20:43

pelikhan marked this pull request as ready for review August 18, 2026 21:13

Copilot AI balanced review requested due to automatic review settings August 18, 2026 21:13

pelikhan merged commit 157cf97 into main Aug 18, 2026

pelikhan deleted the copilot/add-review-agentic-workflows-skill branch August 18, 2026 21:13

Copilot AI reviewed Aug 18, 2026

View reviewed changes


		### Step 0) Verify repository and install CLI when missing

		```bash

Uh oh!

Conversation

Copilot AI commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 18, 2026

PR Triage

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 18, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 18, 2026

Uh oh!

Copilot AI commented Aug 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 18, 2026 •

edited

Loading