Fix missing Undici dependency in Copilot SDK workflows by Copilot · Pull Request #57057 · github/gh-aw

Copilot · 2026-08-30T04:22:55Z

The jsweep Copilot SDK run failed before agent execution because its web-fetch driver could not resolve undici.

SDK setup
- Install pinned undici@6.28.0 alongside @github/copilot-sdk for Node-based SDK and inline-driver setups.
- Regenerate affected workflow lock files.
Regression coverage
- Assert generated Node SDK install steps include the web-fetch dependency.

run: cd "${GITHUB_WORKSPACE}" && npm install --ignore-scripts --no-save @github/copilot-sdk@1.0.11 undici@6.28.0

Fixes [aw] jsweep - JavaScript Unbloater failed #57049

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

🟡 Changes recommended

The TypeScript SDK installation path still omits undici, allowing the reported failure to recur.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds the missing pinned undici dependency to generated Copilot SDK workflow installations, addressing #57049.

Changes:

Adds undici@6.28.0 to default and inline Node.js SDK installs.
Refactors custom-command installation handling.
Adds regression coverage and regenerates affected workflow locks.

File summaries

File	Description
`pkg/workflow/copilot_engine_installation.go`	Updates SDK installation generation.
`pkg/workflow/copilot_engine_basic_test.go`	Tests the new dependency.
`.github/workflows/agent-performance-analyzer.lock.yml`	Regenerates SDK install command.
`.github/workflows/architecture-guardian.lock.yml`	Regenerates SDK install command.
`.github/workflows/breaking-change-checker.lock.yml`	Regenerates SDK install command.
`.github/workflows/ci-coach.lock.yml`	Regenerates SDK install command.
`.github/workflows/cli-consistency-checker.lock.yml`	Regenerates SDK install command.
`.github/workflows/code-scanning-fixer.lock.yml`	Regenerates SDK install command.
`.github/workflows/copilot-cli-deep-research.lock.yml`	Regenerates SDK install command.
`.github/workflows/copilot-opt.lock.yml`	Regenerates SDK install command.
`.github/workflows/copilot-pr-merged-report.lock.yml`	Regenerates SDK install command.
`.github/workflows/copilot-pr-nlp-analysis.lock.yml`	Regenerates SDK install command.
`.github/workflows/copilot-pr-prompt-analysis.lock.yml`	Regenerates SDK install command.
`.github/workflows/craft.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-action-setup-security-audit.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-ambient-context-optimizer.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-assign-issue-to-user.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-compiler-quality.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-experiment-report.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-formal-spec-verifier.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-geo-optimizer.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-github-docs-seo-optimizer.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-graft-intelligence.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-issues-report.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-malicious-code-scan.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-mcp-concurrency-analysis.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-model-inventory.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-model-resolution.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-pr-review-cursor.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-regression-audit-kiro.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-safe-output-integrator.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-schema-audit-cursor.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-secrets-analysis.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-security-observability.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-spdd-spec-planner.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-spec-coverage-kiro.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-syntax-error-quality.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-testify-uber-super-expert.lock.yml`	Regenerates SDK install command.
`.github/workflows/daily-workflow-updater.lock.yml`	Regenerates SDK install command.
`.github/workflows/dead-code-remover.lock.yml`	Regenerates SDK install command.
`.github/workflows/delight.lock.yml`	Regenerates SDK install command.
`.github/workflows/deployment-incident-monitor.lock.yml`	Regenerates SDK install command.
`.github/workflows/dev-hawk.lock.yml`	Regenerates SDK install command.
`.github/workflows/dictation-prompt.lock.yml`	Regenerates SDK install command.
`.github/workflows/docs-noob-tester.lock.yml`	Regenerates SDK install command.
`.github/workflows/draft-pr-cleanup.lock.yml`	Regenerates SDK install command.
`.github/workflows/eslint-miner.lock.yml`	Regenerates SDK install command.
`.github/workflows/firewall-escape.lock.yml`	Regenerates SDK install command.
`.github/workflows/firewall.lock.yml`	Regenerates SDK install command.
`.github/workflows/jsweep.lock.yml`	Fixes the reported workflow setup.
`.github/workflows/layout-spec-maintainer.lock.yml`	Regenerates SDK install command.
`.github/workflows/linter-miner.lock.yml`	Regenerates SDK install command.
`.github/workflows/mcp-inspector.lock.yml`	Regenerates SDK install command.
`.github/workflows/mergefest.lock.yml`	Regenerates SDK install command.
`.github/workflows/org-health-report.lock.yml`	Regenerates SDK install command.
`.github/workflows/plan.lock.yml`	Regenerates SDK install command.
`.github/workflows/pr-nitpick-reviewer.lock.yml`	Regenerates SDK install command.
`.github/workflows/pr-triage-agent.lock.yml`	Regenerates SDK install command.
`.github/workflows/q.lock.yml`	Regenerates SDK install command.
`.github/workflows/smoke-copilot-sdk.lock.yml`	Regenerates SDK smoke coverage.
`.github/workflows/smoke-copilot-sub-agents.lock.yml`	Regenerates SDK install commands.

Review details

Files reviewed: 63/63 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot · 2026-08-30T05:16:03Z

 		runtimeID: runtimeID,
 		stepName:  "Install GitHub Copilot SDK (Node.js)",
-		command:   workspaceCommandPrefix + "npm install --ignore-scripts --no-save @github/copilot-sdk@" + version,
+		command:   workspaceCommandPrefix + "npm install --ignore-scripts --no-save @github/copilot-sdk@" + version + " " + copilotSDKWebFetchDependency,


Fixed in 74ece61 by adding the pinned undici dependency to the TypeScript Copilot SDK install command. Follow-up 32e5a3a keeps the test expectation tied to the shared dependency constant.

github-actions · 2026-08-30T04:45:02Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-30T04:45:10Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-30T04:45:10Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-30T04:45:11Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-30T04:45:15Z

⚠️ Security scanning failed for Ponytail Reviewer. Review the logs for details.

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #57057

github-actions · 2026-08-30T04:48:55Z

Comment Memory

reviewed_at: 2026-08-30T04:46:40.879+00:00
review_event: COMMENT
top_themes:
  - no actionable blocking issues
files_reviewed:
  - pkg/workflow/copilot_engine_installation.go
  - pkg/workflow/copilot_engine_basic_test.go
  - .github/workflows/*.lock.yml
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 29.4 AIC · ⌖ 7.31 AIC · ⊞ 23.5K · ◷
_{Comment /review to run again}

github-actions

Verdict

No blocking issues found in the changed lines.

Reviewed themes

The change is narrowly scoped: the Node.js Copilot SDK install path now consistently includes the pinned undici dependency, and the regression test asserts that requirement. I checked the engine install helper and the added test coverage; I did not find a correctness, security, or maintainability regression in the modified code.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 29.4 AIC · ⌖ 7.31 AIC · ⊞ 23.5K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /tdd and /diagnosing-bugs — one inline comment requesting a missing regression test.

📋 Key Themes & Highlights

Key Themes

Root cause addressed: undici@6.28.0 is now pinned alongside @github/copilot-sdk in both getCopilotSDKInstallSpec and getInlineCopilotSDKInstallSpec via the shared copilotSDKWebFetchDependency constant — clean, DRY fix.
Regression test added for the standard SDK path — TestCopilotEngineInstallationSteps now asserts copilotSDKWebFetchDependency is present.
Inline-driver path not covered — TestCopilotEngineInstallationWithInlineDriver does not assert that the node inline driver install command includes undici, leaving getInlineCopilotSDKInstallSpec without a regression guard (see inline comment).
Refactor is clean: the duplicate if isFirewallEnabled block extracted into getCustomCopilotCommandInstallationSteps improves readability with no observable behaviour change.
Lock-file regeneration: all 63 lock files correctly updated — mechanical diff, no review needed.

Positive Highlights

✅ Shared constant copilotSDKWebFetchDependency avoids duplicate version strings across both install specs.
✅ PR description links directly to the failing issue and includes the exact generated npm install command for traceability.
✅ No changes to public API surface; firewall-path and non-firewall-path logic preserved correctly.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet46 · 44.5 AIC · ⌖ 15.2 AIC · ⊞ 7.6K
_{Comment /matt to run again}

github-actions

Impeccable Review — `harden` + `audit`

Change type: bug_fix — all changes are in generated .lock.yml files, uniformly adding undici@6.28.0 alongside @github/copilot-sdk@1.0.11 in every Install GitHub Copilot SDK step.

Findings

Area	Assessment
Correctness	✅ Change is mechanically consistent — identical substitution across all lock files
Security	✅ `undici@6.28.0` is a peer dependency of the Copilot SDK; pinning an explicit version is safer than allowing npm to resolve an arbitrary transitive version
Reliability	✅ No conditional or partial installs; all affected workflows get the same fix
Edge states	No error/empty/loading paths changed

Notes

These are generated lock files. No source workflow markdown (.md) changes are included in the diff. If the undici dependency is needed permanently, the root cause fix in the workflow source and a make recompile would keep lock files in sync with source — worth confirming before removing the WIP flag.
No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet46 · 19.6 AIC · ⌖ 14.6 AIC · ⊞ 6.2K

Done

github-actions · 2026-08-30T04:57:41Z

✅ Great work, Copilot! This PR addresses the jsweep Copilot SDK failure caused by the missing undici dependency. The fix is focused, well-documented, and includes both SDK setup changes and regression test coverage.

What's working well:

Clear explanation of the root cause (web-fetch driver unable to resolve undici)
Pinned dependency version (undici@6.28.0) for stability
Comprehensive workflow lock file regeneration (63 files)
Test coverage added to pkg/workflow/copilot_engine_basic_test.go
Well-structured PR description with regression coverage details

Status: This PR is ready for review. As a core team contribution from the Copilot coding agent, it follows the project's agentic development model outlined in CONTRIBUTING.md.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 45.8 AIC · ⌖ 5.86 AIC · ⊞ 9.3K · ◷

pelikhan · 2026-08-30T05:02:36Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-30T05:16:10Z

@copilot run pr-finisher skill

Ran the pr-finisher flow. Fixed the remaining TypeScript Copilot SDK undici gap in 74ece61 and the follow-up test constant issue in 32e5a3a; local validation passed. CI is stale after the agent push and needs a maintainer re-trigger before merge.

Initial plan

88ffc3f

Copilot AI assigned Copilot and pelikhan Aug 30, 2026

Copilot AI linked an issue Aug 30, 2026 that may be closed by this pull request

[aw] jsweep - JavaScript Unbloater failed #57049

Closed

Copilot started work on behalf of pelikhan August 30, 2026 04:23 View session

Fix Copilot SDK web fetch dependency

96cda6b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan marked this pull request as ready for review August 30, 2026 04:37

Copilot AI balanced review requested due to automatic review settings August 30, 2026 04:37

Copilot started reviewing on behalf of pelikhan August 30, 2026 04:37 View session

Copilot AI changed the title ~~[WIP] Fix jsweep - JavaScript Unbloater engine failure~~ Fix missing Undici dependency in Copilot SDK workflows Aug 30, 2026

Copilot AI requested a review from pelikhan August 30, 2026 04:41

Copilot finished work on behalf of pelikhan August 30, 2026 04:41

Copilot AI reviewed Aug 30, 2026

View reviewed changes

github-actions Bot reviewed Aug 30, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 30, 2026

[aw] Design Decision Gate 🏗️ produced no safe outputs #56986

Closed

github-actions Bot added the needs-review label Aug 30, 2026

github-actions Bot previously requested changes Aug 30, 2026

View reviewed changes

github-actions Bot reviewed Aug 30, 2026

View reviewed changes

This was referenced Aug 30, 2026

[Contribution Check Report] Contribution Check — 2026-08-30 #57016

Open

[pr-sous-chef] PR Sous Chef run report #57003

Open

Copilot started work on behalf of pelikhan August 30, 2026 05:02 View session

Copilot AI and others added 2 commits August 30, 2026 05:11

Install Undici for TypeScript Copilot SDK

74ece61

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Reuse Undici install constant in test

32e5a3a

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 30, 2026 05:16

pelikhan merged commit fe2bca1 into main Aug 30, 2026
30 checks passed

pelikhan deleted the copilot/aw-jsweep-debug-engine-failure branch August 30, 2026 05:21

Uh oh!

Conversation

Copilot AI commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 30, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Impeccable Review — harden + audit

Findings

Notes

Uh oh!

github-actions Bot commented Aug 30, 2026

Uh oh!

pelikhan commented Aug 30, 2026

Uh oh!

Copilot AI commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

Impeccable Review — `harden` + `audit`