Skip to content

chore: use latest release for gh-aw-detection binary instead of pinned version - #51146

Merged
pelikhan merged 1 commit into
mainfrom
copilot/bind-gh-aw-dtection-to-latest-release
Aug 7, 2026
Merged

chore: use latest release for gh-aw-detection binary instead of pinned version#51146
pelikhan merged 1 commit into
mainfrom
copilot/bind-gh-aw-dtection-to-latest-release

Conversation

Copilot AI commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

gh-aw-detection workflows were pinned to a hardcoded v0.4.0 of the gh-aw-threat-detection binary, requiring a manual constant bump on every release.

Changes

  • pkg/constants/version_constants.go: DefaultThreatDetectVersion changed from "v0.4.0" → "latest"
  • actions/setup/sh/install_threat_detect_binary.sh: When "latest" is passed, resolves the actual tag via the GitHub API before downloading — existing explicit version pins continue to work unchanged
# Resolves at runtime to the current latest release tag
bash install_threat_detect_binary.sh latest
# Still supports pinning
bash install_threat_detect_binary.sh v0.4.0
  • pkg/constants/feature_constants.go, pkg/workflow/threat_detection_isolation_test.go: Removed stale "hard-pinned" wording

@pelikhan
chore: bind gh-aw-detection to latest release instead of pinned version
3497bed 
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title chore: bind gh-aw-detection to latest release instead of pinned version chore: use latest release for gh-aw-detection binary instead of pinned version Aug 7, 2026
Copilot AI requested a review from pelikhan August 7, 2026 17:33
@pelikhan
pelikhan marked this pull request as ready for review August 7, 2026 17:34
Copilot AI balanced review requested due to automatic review settings August 7, 2026 17:34
@pelikhan
pelikhan merged commit 91e01b1 into main Aug 7, 2026
@pelikhan
pelikhan deleted the copilot/bind-gh-aw-dtection-to-latest-release branch August 7, 2026 17:34
Copilot AI reviewed Aug 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates threat-detection installation to resolve the latest release dynamically instead of using a hardcoded version.

Changes:

  • Changes the default threat-detection version to latest.
  • Adds GitHub API release-tag resolution.
  • Regenerates affected workflows and updates wording.
Show a summary per file
File Description
pkg/constants/version_constants.go Sets the default detector version to latest.
pkg/constants/feature_constants.go Updates version-resolution documentation.
pkg/workflow/threat_detection_isolation_test.go Removes hard-pinning terminology.
actions/setup/sh/install_threat_detect_binary.sh Resolves latest through the GitHub API.
.github/workflows/ab-testing-advisor.lock.yml Regenerates detector installation.
.github/workflows/agent-performance-analyzer.lock.yml Regenerates detector installation.
.github/workflows/agent-persona-explorer.lock.yml Regenerates detector installation.
.github/workflows/agentic-token-trend-audit.lock.yml Regenerates detector installation.
.github/workflows/api-consumption-report.lock.yml Regenerates detector installation.
.github/workflows/approach-validator.lock.yml Regenerates detector installation.
.github/workflows/archie.lock.yml Regenerates detector installation.
.github/workflows/architecture-guardian.lock.yml Regenerates detector installation.
.github/workflows/archivx-agentic-workflows-analyzer.lock.yml Regenerates detector installation.
.github/workflows/artifacts-summary.lock.yml Regenerates detector installation.
.github/workflows/audit-workflows.lock.yml Regenerates detector installation.
.github/workflows/auto-triage-issues.lock.yml Regenerates detector installation.
.github/workflows/avenger.lock.yml Regenerates detector installation.
.github/workflows/aw-failure-investigator.lock.yml Regenerates detector installation.
.github/workflows/blog-auditor.lock.yml Regenerates detector installation.
.github/workflows/breaking-change-checker.lock.yml Regenerates detector installation.
.github/workflows/changeset.lock.yml Regenerates detector installation.
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml Regenerates detector installation.
.github/workflows/ci-coach.lock.yml Regenerates detector installation.
.github/workflows/ci-doctor.lock.yml Regenerates detector installation.
.github/workflows/claude-code-user-docs-review.lock.yml Regenerates detector installation.
.github/workflows/cli-consistency-checker.lock.yml Regenerates detector installation.
.github/workflows/cli-version-checker.lock.yml Regenerates detector installation.
.github/workflows/cloclo.lock.yml Regenerates detector installation.
.github/workflows/code-scanning-fixer.lock.yml Regenerates detector installation.
.github/workflows/commit-changes-analyzer.lock.yml Regenerates detector installation.
.github/workflows/constraint-solving-potd.lock.yml Regenerates detector installation.
.github/workflows/contribution-check.lock.yml Regenerates detector installation.
.github/workflows/copilot-agent-analysis.lock.yml Regenerates detector installation.
.github/workflows/copilot-cli-deep-research.lock.yml Regenerates detector installation.
.github/workflows/copilot-opt.lock.yml Regenerates detector installation.
.github/workflows/copilot-pr-merged-report.lock.yml Regenerates detector installation.
.github/workflows/copilot-pr-nlp-analysis.lock.yml Regenerates detector installation.
.github/workflows/copilot-pr-prompt-analysis.lock.yml Regenerates detector installation.
.github/workflows/copilot-session-insights.lock.yml Regenerates detector installation.
.github/workflows/craft.lock.yml Regenerates detector installation.
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml Regenerates detector installation.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml Regenerates detector installation.
.github/workflows/daily-ambient-context-optimizer.lock.yml Regenerates detector installation.
.github/workflows/daily-architecture-diagram.lock.yml Regenerates detector installation.
.github/workflows/daily-assign-issue-to-user.lock.yml Regenerates detector installation.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml Regenerates detector installation.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml Regenerates detector installation.
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml Regenerates detector installation.
.github/workflows/daily-byok-ollama-test.lock.yml Regenerates detector installation.
.github/workflows/daily-cache-strategy-analyzer.lock.yml Regenerates detector installation.
.github/workflows/daily-caveman-optimizer.lock.yml Regenerates detector installation.
.github/workflows/daily-choice-test.lock.yml Regenerates detector installation.
.github/workflows/daily-cli-performance.lock.yml Regenerates detector installation.
.github/workflows/daily-cli-tools-tester.lock.yml Regenerates detector installation.
.github/workflows/daily-code-metrics.lock.yml Regenerates detector installation.
.github/workflows/daily-community-attribution.lock.yml Regenerates detector installation.
.github/workflows/daily-compiler-quality.lock.yml Regenerates detector installation.
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml Regenerates detector installation.
.github/workflows/daily-credit-limit-test.lock.yml Regenerates detector installation.
.github/workflows/daily-doc-healer.lock.yml Regenerates detector installation.
.github/workflows/daily-doc-updater.lock.yml Regenerates detector installation.
.github/workflows/daily-elixir-credo-snippet-audit.lock.yml Regenerates detector installation.
.github/workflows/daily-evals-report.lock.yml Regenerates detector installation.
.github/workflows/daily-experiment-report.lock.yml Regenerates detector installation.
.github/workflows/daily-fact.lock.yml Regenerates detector installation.
.github/workflows/daily-file-diet.lock.yml Regenerates detector installation.
.github/workflows/daily-formal-spec-verifier.lock.yml Regenerates detector installation.
.github/workflows/daily-function-namer.lock.yml Regenerates detector installation.
.github/workflows/daily-geo-optimizer.lock.yml Regenerates detector installation.
.github/workflows/daily-graft-intelligence.lock.yml Regenerates detector installation.
.github/workflows/daily-hippo-learn.lock.yml Regenerates detector installation.
.github/workflows/daily-issues-report.lock.yml Regenerates detector installation.
.github/workflows/daily-max-ai-credits-test.lock.yml Regenerates detector installation.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml Regenerates detector installation.
.github/workflows/daily-model-inventory.lock.yml Regenerates detector installation.
.github/workflows/daily-model-resolution.lock.yml Regenerates detector installation.
.github/workflows/daily-multi-device-docs-tester.lock.yml Regenerates detector installation.
.github/workflows/daily-news.lock.yml Regenerates detector installation.
.github/workflows/daily-observability-report.lock.yml Regenerates detector installation.
.github/workflows/daily-performance-summary.lock.yml Regenerates detector installation.
.github/workflows/daily-reliability-review.lock.yml Regenerates detector installation.
.github/workflows/daily-rendering-scripts-verifier.lock.yml Regenerates detector installation.
.github/workflows/daily-repo-chronicle.lock.yml Regenerates detector installation.
.github/workflows/daily-testify-uber-super-expert.lock.yml Regenerates detector installation.
.github/workflows/daily-token-consumption-report.lock.yml Regenerates detector installation.
.github/workflows/design-decision-gate.lock.yml Regenerates detector installation.
.github/workflows/detection-analysis-report.lock.yml Regenerates detector installation.
.github/workflows/docs-noob-tester.lock.yml Regenerates detector installation.
.github/workflows/duplicate-code-detector.lock.yml Regenerates detector installation.
.github/workflows/example-workflow-analyzer.lock.yml Regenerates detector installation.
.github/workflows/github-mcp-structural-analysis.lock.yml Regenerates detector installation.
.github/workflows/github-remote-mcp-auth-test.lock.yml Regenerates detector installation.
.github/workflows/impeccable-skills-reviewer.lock.yml Regenerates detector installation.
.github/workflows/issue-monster.lock.yml Regenerates detector installation.
.github/workflows/mattpocock-skills-reviewer.lock.yml Regenerates detector installation.
.github/workflows/pr-code-quality-reviewer.lock.yml Regenerates detector installation.
.github/workflows/pr-description-caveman.lock.yml Regenerates detector installation.
.github/workflows/pr-sous-chef.lock.yml Regenerates detector installation.
.github/workflows/prompt-clustering-analysis.lock.yml Regenerates detector installation.
.github/workflows/test-quality-sentinel.lock.yml Regenerates detector installation.
.github/workflows/typist.lock.yml Regenerates detector installation.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (2)

actions/setup/sh/install_threat_detect_binary.sh:64

  • With set -euo pipefail, any curl/grep failure makes this assignment terminate the script immediately, so the actionable error on lines 65–68 is never reached for the API failures it is meant to handle. Normalize a failed pipeline to an empty value so the existing check reports the intended error.
    actions/setup/sh/install_threat_detect_binary.sh:64
  • This request is unauthenticated, so it is subject to GitHub's low unauthenticated REST rate limit (60 requests/hour per source IP). Since every generated detection workflow now performs this lookup, runs sharing an egress IP can receive a 403 and fail installation. Authenticate with the workflow token (passed to this step without logging it), or resolve releases/latest through the non-API release redirect.
  • Files reviewed: 101/101 changed files
  • Comments generated: 2
  • Review effort level: Balanced

Comment thread actions/setup/sh/install_threat_detect_binary.sh
Comment on lines +60 to +64
if [ "$THREAT_DETECT_VERSION" = "latest" ]; then
echo "Resolving latest threat-detect version from GitHub API..."
THREAT_DETECT_VERSION=$(curl -fsSL --retry 5 --retry-delay 10 --retry-max-time 180 \
"https://github.com/ghapi/repos/${THREAT_DETECT_REPO}/releases/latest" | \
grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
Comment thread actions/setup/sh/install_threat_detect_binary.sh
Comment on lines +59 to +60
# Resolve "latest" to the actual release tag via the GitHub API
if [ "$THREAT_DETECT_VERSION" = "latest" ]; then
@github-actions github-actions Bot mentioned this pull request Aug 7, 2026
Closed
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.86.1

This was referenced Aug 7, 2026
Closed
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@pelikhan pelikhan Awaiting requested review from pelikhan

Assignees

@pelikhan pelikhan

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@pelikhan