[pull] trunk from cli:trunk - #14
Open
pull[bot] wants to merge 668 commits into
Open
Conversation
…er/goreleaser-action-7.2.3 chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
…ples docs(search): add examples for multiple qualifiers
Introduce a dry_run input (default true) to the deployment workflow so artifacts are built and signed but no GitHub Release is created and no site is published. Rename DO_PUBLISH to DO_SIGN_ARTIFACTS for the Windows signing path so signing remains driven solely by environment, independent of publish gating, and set it on the MSI signing step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Rework the macOS deployment signing to use App Store Connect API key based notarization and a Developer ID certificate identifier. - Use a single consistent keychain (build.keychain) for signing and notarization; the notarization credentials previously targeted a keychain that was never created. - Gate the App Store Connect API key and notarization credential steps on the production environment so non-production builds (with empty secrets) no longer fail. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Convert the deployment workflow from reusable `workflow_call` to manual `workflow_dispatch`, removing the extra `repository` input and forwarded secret declarations. Drop per-job deploy app token generation and custom checkout token/repository overrides, relying on the default checkout context instead. Update release publishing to use `secrets.GITHUB_TOKEN` for GH CLI authentication.
Net-new draft agentic issue-triage labeller for cli/cli built with gh-aw. On a newly opened issue (or manual workflow_dispatch) an agent reads the issue and, only when confident, applies a small allowlist of existing cli/cli labels and posts one short rationale comment via native issue-intents safe outputs. Conservative starting point for discussion, not a final triage configuration. Inert until issue_intents is enabled for the org/repo and a repo admin sets the GH_AW_RUNTIME_FEATURES=issue_intents repository variable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Rework the draft workflow to follow gh-cli-and-desktop triage-process.md: the objective is to drive an issue toward removing needs-triage by landing the minimal correct end-state labels, surfaced for maintainer approval via issue-intents rationale and confidence rather than silent auto-apply. - Prompt now follows the documented issues decision tree (closeable / duplicate / spam / abuse / off-topic / no-help-wanted-issue, then bug + priority or unable-to-reproduce, then enhancement or more-info-needed). - add-labels allowlist switched to the real cli/cli triage taxonomy: bug, priority-1/2/3, enhancement, more-info-needed, unable-to-reproduce, off-topic, no-help-wanted-issue, invalid, suspected-spam, duplicate. needs-triage is intentionally excluded (the agent must not add it). - max labels 3, add-comment max 1; engine copilot, strict:false, permissions contents:read + issues:read, github toolset [issues], triggers issues:opened + workflow_dispatch, timeout 10m, intents wiring unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Helps debug 'no identity found' failures by printing the codesigning identities available in the build keychain, so DEVELOPER_ID_CERT_IDENTIFIER can be verified against the actual imported certificate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reflects the reworked macOS code-signing/notarization flow (dedicated build.keychain, App Store Connect API key, notarytool keychain profile, DEVELOPER_ID_CERT_IDENTIFIER/MAC_APP_SIGNING_IDENTITY), documents the new dry_run input and its publishing gates, the ref input and per-job timeouts, the Windows DO_SIGN_ARTIFACTS flag, and the GitHub App site deploy token replacing SITE_DEPLOY_PAT. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The deployment workflow's dry_run input defaults to true so manual UI dispatches are safe by default. script/release, however, is used to initiate real releases, so it now passes -f dry_run=false and exposes an opt-in --dry-run flag. Without this, releases triggered via script/release silently became no-ops (no attestation, no GitHub Release, no site push). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The ref input was added in anticipation of calling this workflow via workflow_call from another repo. Since it remains a workflow_dispatch workflow, drop the input and let actions/checkout default to the ref that triggered the dispatch (the --ref passed to gh workflow run). This also fixes script/release --branch, which previously selected the workflow file ref but still built trunk because inputs.ref defaulted to trunk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Interpolating ${{ secrets.* }} directly into the run: script meant a
certificate password containing a single quote (or other shell
metacharacters) would break quoting and could inject commands. Map the
cert and password into the step env and reference them as quoted shell
variables instead, and remove the temporary .p12 after import.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Mirror the Windows job: script/sign now skips codesign/notarization unless DO_SIGN_ARTIFACTS is set to a non-false value, and the macOS Build and Notarize steps set it to production-only. Previously, staging macOS builds would run codesign against a keychain that was never provisioned (the cert-install step is production-only) whenever MAC_APP_SIGNING_IDENTITY was defined at repository scope, breaking non-production builds. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Append a '(dry run)' suffix to run-name when inputs.dry_run is true so dry runs are distinguishable from real deployments in the Actions UI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@82606bf...ba0d7d2) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…/golangci-lint-action-9.3.0 chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Route release creation through api.Client
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 127aa8fc-0468-4e3d-afec-4587cda12d7a
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cd6441de-bed4-4adb-88c3-904b349ba16f
…e-guidance Tell agents to use the PR template in AGENTS.md
Set GH_EXTENSION=1 when gh invokes an extension
The triage workflow spent an LLM turn deciding it had nothing to do. A no-op scheduled run cost 50-75 AI Credits because the agent walked the dedup protocol itself: fetching open PRs, reading every prior triage comment, and comparing head SHAs. That work is entirely deterministic, and the most expensive single call was the agent re-ingesting its own past comments, so the cost grew every time the workflow commented. Move that comparison into a shell step that runs after checkout but before the engine starts. It writes a work list to /tmp/gh-aw/dependabot-worklist.json, and when the list is empty it emits a `noop` safe output, which makes the harness exit before any inference is billed. This also hardens scope. The agent no longer decides which PRs are in range, so it cannot be talked into assessing a PR outside the work list by content in a PR it is reading. `issues: read` is needed because PR conversation comments are served by the issues API, and the timeout moves to 30 minutes because the runs that do have work now do strictly more evidence gathering per PR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190d246d-0b1f-4ce6-9aa6-dee10d3d4cf8
The triager almost never returned High confidence, and when its prose disagreed with a human reviewer it was usually because it had guessed at something it could have read. It named workflow files that do not exist in this repository, and it called a direct `go.mod` requirement indirect. Both mistakes share a cause: the skill never told the agent to look at the PR's own diff or at the checked-out source tree. It had access to both the whole time. So replace inference with five required evidence items - the diff, the dependency's position in the manifest, the repository's actual import surface, CI state, and upstream release evidence - and make High confidence conditional on having gathered them. The old definition of High was unreachable by construction. It asked for the upstream change to be read "end to end" while a separate instruction capped confidence at Medium rather than reading indefinitely, so any non-trivial bump fell through to Medium no matter how clear it was. Redefine High as decision-relevant completeness: a four-release bump that touches nothing this repository imports is High once you have verified that, because reading the rest could not change the answer. Also drop the dedup protocol, which the pre-flight step now performs deterministically, and add an in-repo coherence check for bumps that edit generated files without updating the version each file records - the gh-aw lock files being the case that prompted it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190d246d-0b1f-4ce6-9aa6-dee10d3d4cf8
The evidence rule told the agent that a dependency in the first `require` block is direct. That is a `go mod tidy` formatting convention, not the semantics. What actually marks a requirement indirect is the trailing `// indirect` comment on its own line, and Go's parser reads it that way regardless of block: put a commented and an uncommented require in the same block and `go mod edit -json` still reports Indirect true and false respectively. The two agree in this repository today, so nothing was misclassified. But the rule would break on a reorganised or hand-edited file, and misreporting a direct dependency as indirect is precisely the error the required-evidence section exists to prevent. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190d246d-0b1f-4ce6-9aa6-dee10d3d4cf8
Adding a custom pre-agent `steps:` block made the compiler wrap it in a DIFC proxy, because a guard policy is configured. That proxy applies `min-integrity` but not `trusted-users`, which are resolved at runtime after it starts. The pre-flight finds its dedup marker by reading back its own `cli-triage[bot]` comments, and those are precisely what `min-integrity: approved` filters out - the app posts with author_association NONE, which is why `trusted-users` exists here at all. So the marker was never found, every open Dependabot PR looked unassessed on every run, and the workflow would have re-triaged and re-commented on all of them hourly: the exact failure this design was written to prevent, moved from the agent to a place with no model to notice it. Turning the proxy off does not widen the injection surface. The pre-flight hands nothing it reads to the model - it extracts PR numbers, head SHAs and CI states - and it matches the marker only inside comments already narrowed to the app's own login. That login check, not integrity, is what stops a third party forging a marker. The agent still runs under the full policy via the MCP gateway. Verified against cli/cli: all seven open Dependabot PRs are correctly recognised as already assessed at their current head, and a run with the login filter pointed at a non-existent bot correctly reports them as needing assessment. Three smaller corrections ride along, all fallout from the same review: - Silence no-op issue reporting. gh-aw posts a comment to a shared "no-op runs" issue on every noop, and noop is now the routine idle outcome of an hourly reconciler, so that would have been roughly 24 comments a day forever. The run log already records why a run did nothing. - Drop CI state from the required-evidence count. The pre-flight now guarantees terminal CI, so the agent never gathers it and it could never be the missing item that caps confidence. Counting it made the gate for High confidence four items dressed up as five. - Log which PRs the terminal-CI gate excluded. A check that never reports would otherwise keep a PR out of triage permanently and silently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695
`statusCheckRollup` contexts are CheckRun and StatusContext objects, which sit behind the `checks` and `statuses` scopes. The workflow token had neither, so the field would have come back unreadable at runtime even though it reads fine with a developer token, which is what I tested with. The dangerous part was not the missing permission but how the gate reacted to it. `[.statusCheckRollup[]? | select(pending)] | length == 0` cannot tell "this PR has no checks" from "I could not read this PR's checks", so an unreadable rollup counted as terminal CI and the PR would have been assessed while its CI was still running. Silently wrong beats loudly broken only from the outside. So the classification now treats a null rollup as pending and names it in the skip log, and the permissions are granted. The gate fails safe if either is ever dropped again. Also warn when the listing hits the 100-PR cap. gh truncates silently and the ordering is stable, so PRs past the cap would never be reached on a later run either. Paginating for a case that far outside anything this repository has seen, and well above the 20-comment safe-output cap, is not worth the extra requests, but the condition should not be invisible. Reported by Copilot review on #14079. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695
Make Dependabot triage cheaper and more decisive
…igstore/sigstore-go-1.3.0 chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.7 to 0.21.8. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.7...v0.21.8) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…ctions-432e0d4de6 chore(deps): bump the codeql-actions group across 1 directory with 3 updates
…g.org/grpc-1.83.0 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0
…oogle/go-containerregistry-0.21.8 chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cd6661ad-7e77-46d0-b0e7-0a296f4e252b
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695
Copilot-Session: e00d0ec3-c3d6-4ee7-9100-a7f294fe2402
…attest-4.2.1 chore(deps): bump actions/attest from 4.2.0 to 4.2.1
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: 7db06537-cb57-48b9-b09c-e0ea393c3734 Copilot-Session: 6dba8ad8-2a85-4cda-a057-cf91b58a158e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: db48c8cb-9607-4607-8000-121b01833106
Agents were filling "How did you test this change?" with unit test output, which duplicates CI and tells reviewers nothing about whether the change actually works for a user. Spell out the acceptable forms instead: screenshots/GIFs, Given/When/Then, or a plain walkthrough. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: af0c0477-c30c-4c0f-b198-42ce0cd450f3
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: db48c8cb-9607-4607-8000-121b01833106
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Clarify what belongs in the PR template's testing section
Bump golangci-lint in CI to v2.12.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )