Fix Contribution Check proxy denials and retry handling

[Copilot]

Contribution Check was hitting AWF proxy permission denials for normal workflow work: fetching PR diffs and emitting the summary issue. The harness also treated AWF proxy blocks as non-retryable, exhausting the run after the first attempt.

• Allow required Contribution Check shell commands

  • Adds git for PR branch fetch/diff operations.
  • Adds jq * for constructing safe-output payloads.
  • Recompiles the generated lockfile so the agent receives:

    --allow-tool 'shell(git:*)'
    --allow-tool 'shell(jq)'
    --allow-tool 'shell(safeoutputs:*)'

• Make AWF proxy blocks retryable in Copilot harness

  • Keeps detecting AWF API-proxy block markers.
  • Removes them from the non-retryable guard path so transient proxy blocks can consume retry budget.

• Add regression coverage

  • Verifies Contribution Check keeps the required shell permissions in source and compiled workflow output.
  • Verifies Copilot retry policy retries AWF proxy block output instead of treating it as a terminal guard condition.

• Fixes [aw-failures] [P1] Fix Contribution Check's AWF proxy block — 19 permission denials, 0 retries used #51629

[github-actions]

Excellent work, Copilot! This PR comprehensively addresses the AWF proxy permission issues blocking Contribution Check workflows. The implementation is well-described and properly scoped:

• Clear problem and solution: Fixes proxy denials for git and jq shell commands, makes AWF blocks retryable
• Focused scope: 45 lines across 5 files
• Regression coverage: includes tests
• Issue reference: Fixes [aw-failures] [P1] Fix Contribution Check's AWF proxy block — 19 permission denials, 0 retries used #51629

The PR is well-prepared and ready for team review.

Generated by ✅ Contribution Check · auto · 90.6 AIC · ⌖ 3.4 AIC · ⊞ 8.8K · ◷

[github-actions]

Triage

• Category: bug
• Risk: medium (touches lockfile-generating workflow + retry-guard logic)
• Score: 62/100 (impact 25, urgency 22, quality 15)
• Recommended action: fast_track

Draft with 1 comment, all CI checks pending/unavailable. Fixes real proxy-denial + non-retryable-block bug in Contribution Check harness that affects every subsequent AWF-proxy-blocked run. Recommend undraft + CI run before merge.

Generated by 🔧 PR Triage Agent · auto · 43.1 AIC · ⌖ 1.95 AIC · ⊞ 7.8K · ◷

[Copilot]

Pull request overview

Fixes Contribution Check command permissions and Copilot harness retry handling.

Changes:

• Allows required git and jq shell commands.
• Makes AWF proxy blocks retryable.
• Adds workflow-contract and retry regression tests.

Show a summary per file

File	Description
.github/workflows/contribution-check.md	Adds shell permissions.
.github/workflows/contribution-check.lock.yml	Recompiles generated permissions.
actions/setup/js/copilot_harness.cjs	Removes AWF proxy blocks from one terminal guard.
actions/setup/js/copilot_harness.test.cjs	Adds retry regression coverage.
pkg/cli/contribution_check_workflow_contract_test.go	Verifies source and compiled permissions.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2