Restrict agent artifact packaging to known files by Copilot · Pull Request #59334 · github/gh-aw

Copilot · 2026-09-08T01:57:50Z

Agent artifacts currently include user-generated files under /tmp/gh-aw/agent/, causing uncontrolled artifact growth. This change switches packaging to explicit runtime outputs.

Changes

Remove the broad /tmp/gh-aw/agent/ artifact path.
Preserve gateway and firewall logs, engine session files, and agent logs.
Explicitly include Claude’s debug log.
Add regression coverage preventing user-generated directories from being packaged.

Run: https://github.com/github/gh-aw/actions/runs/34185177055

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 45.4 AIC · ⌖ 8.71 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-09-08T02:02:30Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-09-08T02:02:38Z

✅ Ponytail Reviewer completed successfully!

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #59334

github-actions · 2026-09-08T02:02:43Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com/ghapi
github.com

[!TIP]
github.com/ghapi is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding github.com/ghapi to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to github.com/ghapi:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com/ghapi"
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-09-08T02:03:09Z

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com/ghapi
github.com

[!TIP]
github.com/ghapi is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding github.com/ghapi to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to github.com/ghapi:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com/ghapi"
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-09-08T02:03:42Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-09-08T02:07:58Z

Comment Memory

reviewed_at: 2026-09-08T02:04:28Z
review_event: COMMENT
top_themes:
  - no-blocking-issues-found
  - artifact-path-tightening-preserves-known-runtime-outputs
files_reviewed:
  - actions/setup/sh/collect_usage_artifact_files.sh
  - pkg/cli/firewall_policy.go
  - pkg/cli/firewall_policy_test.go
  - .github/workflows/*.lock.yml
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com/ghapi
github.com

[!TIP]
github.com/ghapi is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding github.com/ghapi to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to github.com/ghapi:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com/ghapi"
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 58.1 AIC · ⌖ 7.32 AIC · ⊞ 23.5K · ◷
_{Comment /review to run again}

github-actions

Verdict

I dont see a blocking regression in this change.

Review notes

The risky part here was whether dropping the broad /tmp/gh-aw/agent/ upload would strand logs or break downstream firewall-audit discovery. The regenerated lockfiles consistently replace that directory with explicit file paths, including the Claude-specific debug log only in workflows that actually need it, and the runtime code in detectFirewallAuditArtifacts still handles both flattened and legacy artifact layouts. I also didnt find an implementation-side regression in the remaining shell and Go changes surfaced in this checkout.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com/ghapi
github.com

[!TIP]
github.com/ghapi is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding github.com/ghapi to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to github.com/ghapi:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com/ghapi"
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 58.1 AIC · ⌖ 7.32 AIC · ⊞ 23.5K
_{Comment /review to run again}

Copilot

🟡 Changes recommended

Critical test and golden-fixture failures must be resolved before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Restricts agent artifact packaging to explicit runtime outputs, preventing uncontrolled uploads of user-generated files.

Changes:

Removes broad /tmp/gh-aw/agent/ artifact collection.
Preserves known runtime logs, including Claude’s debug log.
Adds regression coverage and regenerates workflow lock files.

File summaries

File	Review
`pkg/workflow/engine_output_test.go`	Adds Claude artifact-path coverage.
`pkg/workflow/compiler_yaml_post_agent.go`	Critical (1 vote): WASM golden fixtures require regeneration. Nit (1 vote): artifact-retention guidance and tests remain outdated.
`pkg/workflow/compiler_artifacts_test.go`	Tests exclusion of the broad agent directory.
`pkg/workflow/claude_engine.go`	Critical (2 votes): `TestEngineOutputFileDeclarations` must expect `claudeDebugLogFile`.
`.github/workflows/workflow-skill-extractor.lock.yml`	Regenerated artifact paths.
`.github/workflows/workflow-normalizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/workflow-health-manager.lock.yml`	Regenerated artifact paths.
`.github/workflows/workflow-generator.lock.yml`	Regenerated artifact paths.
`.github/workflows/windows.lock.yml`	Regenerated artifact paths.
`.github/workflows/windows-grower.lock.yml`	Regenerated artifact paths.
`.github/workflows/weekly-safe-outputs-spec-review.lock.yml`	Regenerated artifact paths.
`.github/workflows/weekly-network-domains-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/weekly-issue-summary.lock.yml`	Regenerated artifact paths.
`.github/workflows/weekly-editors-health-check.lock.yml`	Regenerated artifact paths.
`.github/workflows/weekly-blog-post-writer.lock.yml`	Regenerated artifact paths.
`.github/workflows/visual-regression-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/video-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/update-astro.lock.yml`	Regenerated artifact paths.
`.github/workflows/unbloat-docs.lock.yml`	Regenerated artifact paths.
`.github/workflows/uk-ai-operational-resilience.lock.yml`	Regenerated artifact paths.
`.github/workflows/ubuntu-image-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/typist.lock.yml`	Regenerated artifact paths.
`.github/workflows/tidy.lock.yml`	Regenerated artifact paths.
`.github/workflows/test-quality-sentinel.lock.yml`	Regenerated artifact paths.
`.github/workflows/terminal-stylist.lock.yml`	Regenerated artifact paths.
`.github/workflows/technical-doc-writer.lock.yml`	Regenerated artifact paths.
`.github/workflows/super-linter.lock.yml`	Regenerated artifact paths.
`.github/workflows/sub-issue-closer.lock.yml`	Regenerated artifact paths.
`.github/workflows/step-name-alignment.lock.yml`	Regenerated artifact paths.
`.github/workflows/static-analysis-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/stale-repo-identifier.lock.yml`	Regenerated artifact paths.
`.github/workflows/stale-pr-cleanup.lock.yml`	Regenerated artifact paths.
`.github/workflows/squad.lock.yml`	Regenerated artifact paths.
`.github/workflows/squad-plan.lock.yml`	Regenerated artifact paths.
`.github/workflows/squad-implement-worker.lock.yml`	Regenerated artifact paths.
`.github/workflows/squad-game-planner.lock.yml`	Regenerated artifact paths.
`.github/workflows/spec-librarian.lock.yml`	Regenerated artifact paths.
`.github/workflows/spec-extractor.lock.yml`	Regenerated artifact paths.
`.github/workflows/spec-enforcer.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-workflow-call.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-workflow-call-with-inputs.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-update-cross-repo-pr.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-test-tools.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-temporary-id.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-service-ports.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-pydantic.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-project.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-pi.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-otel-backends.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-opencode.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-multi-pr.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-kiro.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-issues.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-goose.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-github-claude.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-gemini.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-drive.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-deepseek-harness.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-cursor.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-crush.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-create-cross-repo-pr.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-sub-agents.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-small.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-sdk.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-mai.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-auto.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-arm.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-aoai-entra.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-copilot-aoai-apikey.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-codex.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-claude.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-claude-on-copilot.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-ci.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-checkout-pr-dispatch.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-call-workflow.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-aider.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-agent-scoped-approved.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-agent-public-none.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-agent-public-approved.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-agent-all-none.lock.yml`	Regenerated artifact paths.
`.github/workflows/smoke-agent-all-merged.lock.yml`	Regenerated artifact paths.
`.github/workflows/slide-deck-maintainer.lock.yml`	Regenerated artifact paths.
`.github/workflows/skillet.lock.yml`	Regenerated artifact paths.
`.github/workflows/sighthound-security-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/sergo.lock.yml`	Regenerated artifact paths.
`.github/workflows/semantic-function-refactor.lock.yml`	Regenerated artifact paths.
`.github/workflows/security-review.lock.yml`	Regenerated artifact paths.
`.github/workflows/security-compliance.lock.yml`	Regenerated artifact paths.
`.github/workflows/scout.lock.yml`	Regenerated artifact paths.
`.github/workflows/schema-feature-coverage.lock.yml`	Regenerated artifact paths.
`.github/workflows/schema-consistency-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/safe-output-health.lock.yml`	Regenerated artifact paths.
`.github/workflows/ruflo-backed-task.lock.yml`	Regenerated artifact paths.
`.github/workflows/research.lock.yml`	Regenerated artifact paths.
`.github/workflows/repository-quality-improver.lock.yml`	Regenerated artifact paths.
`.github/workflows/repo-tree-map.lock.yml`	Regenerated artifact paths.
`.github/workflows/repo-audit-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/release.lock.yml`	Regenerated artifact paths.
`.github/workflows/refiner.lock.yml`	Regenerated artifact paths.
`.github/workflows/refactoring-cadence.lock.yml`	Regenerated artifact paths.
`.github/workflows/q.lock.yml`	Regenerated artifact paths.
`.github/workflows/python-data-charts.lock.yml`	Regenerated artifact paths.
`.github/workflows/purelock.lock.yml`	Regenerated artifact paths.
`.github/workflows/prompt-clustering-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/pr-triage-agent.lock.yml`	Regenerated artifact paths.
`.github/workflows/pr-sous-chef.lock.yml`	Regenerated artifact paths.
`.github/workflows/pr-nitpick-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/pr-description-caveman.lock.yml`	Regenerated artifact paths.
`.github/workflows/pr-code-quality-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/portfolio-analyst.lock.yml`	Regenerated artifact paths.
`.github/workflows/ponytail-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/poem-bot.lock.yml`	Regenerated artifact paths.
`.github/workflows/plan.lock.yml`	Regenerated artifact paths.
`.github/workflows/pdf-summary.lock.yml`	Regenerated artifact paths.
`.github/workflows/outcome-collector.lock.yml`	Regenerated artifact paths.
`.github/workflows/org-health-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/objective-impact-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/notion-issue-summary.lock.yml`	Regenerated artifact paths.
`.github/workflows/necromancer.lock.yml`	Regenerated artifact paths.
`.github/workflows/metrics-collector.lock.yml`	Regenerated artifact paths.
`.github/workflows/mergefest.lock.yml`	Regenerated artifact paths.
`.github/workflows/mcp-inspector.lock.yml`	Regenerated artifact paths.
`.github/workflows/mattpocock-skills-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/lockfile-stats.lock.yml`	Regenerated artifact paths.
`.github/workflows/linter-miner.lock.yml`	Regenerated artifact paths.
`.github/workflows/lint-monster.lock.yml`	Regenerated artifact paths.
`.github/workflows/layout-spec-maintainer.lock.yml`	Regenerated artifact paths.
`.github/workflows/jsweep.lock.yml`	Regenerated artifact paths.
`.github/workflows/issue-triage-agent.lock.yml`	Regenerated artifact paths.
`.github/workflows/issue-monster.lock.yml`	Regenerated artifact paths.
`.github/workflows/issue-arborist.lock.yml`	Regenerated artifact paths.
`.github/workflows/instructions-janitor.lock.yml`	Regenerated artifact paths.
`.github/workflows/impeccable-skills-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/hourly-ci-cleaner.lock.yml`	Regenerated artifact paths.
`.github/workflows/hippo-embed.lock.yml`	Regenerated artifact paths.
`.github/workflows/grumpy-reviewer.lock.yml`	Regenerated artifact paths.
`.github/workflows/gpclean.lock.yml`	Regenerated artifact paths.
`.github/workflows/go-pattern-detector.lock.yml`	Regenerated artifact paths.
`.github/workflows/go-logger.lock.yml`	Regenerated artifact paths.
`.github/workflows/go-fan.lock.yml`	Regenerated artifact paths.
`.github/workflows/glossary-maintainer.lock.yml`	Regenerated artifact paths.
`.github/workflows/github-remote-mcp-auth-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/github-mcp-tools-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/github-mcp-structural-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/functional-pragmatist.lock.yml`	Regenerated artifact paths.
`.github/workflows/front-page-copy-guard.lock.yml`	Regenerated artifact paths.
`.github/workflows/firewall.lock.yml`	Regenerated artifact paths.
`.github/workflows/firewall-escape.lock.yml`	Regenerated artifact paths.
`.github/workflows/feature-grower.lock.yml`	Regenerated artifact paths.
`.github/workflows/example-workflow-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/example-permissions-warning.lock.yml`	Regenerated artifact paths.
`.github/workflows/example-failure-category-filter.lock.yml`	Regenerated artifact paths.
`.github/workflows/evoskill-evolver.lock.yml`	Regenerated artifact paths.
`.github/workflows/eslint-refiner.lock.yml`	Regenerated artifact paths.
`.github/workflows/eslint-monster.lock.yml`	Regenerated artifact paths.
`.github/workflows/eslint-miner.lock.yml`	Regenerated artifact paths.
`.github/workflows/duplicate-code-detector.lock.yml`	Regenerated artifact paths.
`.github/workflows/draft-pr-cleanup.lock.yml`	Regenerated artifact paths.
`.github/workflows/docs-noob-tester.lock.yml`	Regenerated artifact paths.
`.github/workflows/dictation-prompt.lock.yml`	Regenerated artifact paths.
`.github/workflows/developer-docs-consolidator.lock.yml`	Regenerated artifact paths.
`.github/workflows/dev.lock.yml`	Regenerated artifact paths.
`.github/workflows/dev-hawk.lock.yml`	Regenerated artifact paths.
`.github/workflows/detection-analysis-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/designer-drift-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/design-decision-gate.lock.yml`	Regenerated artifact paths.
`.github/workflows/deployment-incident-monitor.lock.yml`	Regenerated artifact paths.
`.github/workflows/dependabot-go-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/dependabot-burner.lock.yml`	Regenerated artifact paths.
`.github/workflows/delight.lock.yml`	Regenerated artifact paths.
`.github/workflows/deepsec-security-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/deep-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/dead-code-remover.lock.yml`	Regenerated artifact paths.
`.github/workflows/dataflow-pr-discussion-dataset.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-yamllint-fixer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-workflow-updater.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-windows-terminal-integration-builder.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-windows-defender-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-vulnhunter-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-trajectory-grader-implementer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-token-consumption-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-testify-uber-super-expert.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-team-status.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-team-evolution-insights.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-syntax-error-quality.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-storify.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-squid-image-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-spending-forecast.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-spec-coverage-kiro.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-spdd-spec-planner.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-semgrep-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-security-red-team.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-security-observability.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-secrets-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-schema-audit-cursor.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-safeoutputs-git-simulator.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-safe-outputs-conformance.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-safe-output-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-safe-output-integrator.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-repo-chronicle.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-rendering-scripts-verifier.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-reliability-review.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-regulatory.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-regression-audit-kiro.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-pr-review-cursor.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-performance-summary.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-observability-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-news.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-multi-device-docs-tester.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-model-resolution.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-model-inventory.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-mcp-concurrency-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-max-ai-credits-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-malicious-code-scan.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-issues-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-hippo-learn.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-harness-experiment-proposer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-graft-intelligence.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-grader-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-go-test-stubs-aider.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-go-test-parallelizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-github-docs-seo-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-geo-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-function-namer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-formal-spec-verifier.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-firewall-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-file-diet.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-fact.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-experiment-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-evals-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-elixir-credo-snippet-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-documentation-diagram.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-doc-updater.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-doc-healer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-credit-limit-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-compiler-quality.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-community-attribution.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-code-metrics.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-code-debt-aider.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-cli-tools-tester.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-cli-performance.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-choice-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-caveman-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-cache-strategy-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-aw-cross-repo-compile-check.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-assign-issue-to-user.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-arxiv-researcher.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-architecture-diagram.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-ambient-context-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-agentrx-trace-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml`	Regenerated artifact paths.
`.github/workflows/daily-action-setup-security-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/craft.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-session-insights.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-pr-prompt-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-pr-nlp-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-pr-merged-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-opt.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-cli-deep-research.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-centralization-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-centralization-drilldown.lock.yml`	Regenerated artifact paths.
`.github/workflows/copilot-agent-analysis.lock.yml`	Regenerated artifact paths.
`.github/workflows/contribution-check.lock.yml`	Regenerated artifact paths.
`.github/workflows/constraint-solving-potd.lock.yml`	Regenerated artifact paths.
`.github/workflows/commit-changes-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/codex-github-remote-mcp-test.lock.yml`	Regenerated artifact paths.
`.github/workflows/code-simplifier.lock.yml`	Regenerated artifact paths.
`.github/workflows/code-scanning-fixer.lock.yml`	Regenerated artifact paths.
`.github/workflows/cloclo.lock.yml`	Regenerated artifact paths.
`.github/workflows/cli-version-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/cli-consistency-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/claude-code-user-docs-review.lock.yml`	Regenerated artifact paths.
`.github/workflows/ci-doctor.lock.yml`	Regenerated artifact paths.
`.github/workflows/ci-coach.lock.yml`	Regenerated artifact paths.
`.github/workflows/chaos-pr-bundle-fuzzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/changeset.lock.yml`	Regenerated artifact paths.
`.github/workflows/breaking-change-checker.lock.yml`	Regenerated artifact paths.
`.github/workflows/bot-detection.lock.yml`	Regenerated artifact paths.
`.github/workflows/blog-auditor.lock.yml`	Regenerated artifact paths.
`.github/workflows/aw-failure-investigator.lock.yml`	Regenerated artifact paths.
`.github/workflows/avenger.lock.yml`	Regenerated artifact paths.
`.github/workflows/auto-triage-issues.lock.yml`	Regenerated artifact paths.
`.github/workflows/audit-workflows.lock.yml`	Regenerated artifact paths.
`.github/workflows/artifacts-summary.lock.yml`	Regenerated artifact paths.
`.github/workflows/archivx-agentic-workflows-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/architecture-guardian.lock.yml`	Regenerated artifact paths.
`.github/workflows/archie.lock.yml`	Regenerated artifact paths.
`.github/workflows/approach-validator.lock.yml`	Regenerated artifact paths.
`.github/workflows/api-consumption-report.lock.yml`	Regenerated artifact paths.
`.github/workflows/ai-moderator.lock.yml`	Regenerated artifact paths.
`.github/workflows/agentic-token-trend-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/agentic-token-optimizer.lock.yml`	Regenerated artifact paths.
`.github/workflows/agentic-token-audit.lock.yml`	Regenerated artifact paths.
`.github/workflows/agent-persona-explorer.lock.yml`	Regenerated artifact paths.
`.github/workflows/agent-performance-analyzer.lock.yml`	Regenerated artifact paths.
`.github/workflows/agent-job-health.lock.yml`	Regenerated artifact paths.
`.github/workflows/ace-editor.lock.yml`	Regenerated artifact paths.
`.github/workflows/ab-testing-advisor.lock.yml`	Regenerated artifact paths.

Review details

Files reviewed: 300/303 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-09-08T04:10:38Z

+// GetDeclaredOutputFiles returns the diagnostic files that Claude may produce.
 func (e *ClaudeEngine) GetDeclaredOutputFiles() []string {
-	return []string{}
+	return []string{claudeDebugLogFile}


Updated TestEngineOutputFileDeclarations to expect claudeDebugLogFile in commit 7892c24.

Copilot · 2026-09-08T04:10:51Z

@@ -43,11 +43,6 @@ func (c *Compiler) collectArtifactPaths(data *WorkflowData, engine CodingAgentEn
 	// before agent execution) so it is available in the agent artifact for post-run inspection.
 	paths = append(paths, constants.PreAgentAuditFilePath.String())


Regenerated and committed the updated WASM golden fixtures in commit 7892c24.

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd. This is a clean, well-scoped fix.

📋 Analysis

Root cause vs. symptom (/diagnosing-bugs): The change correctly removes the root cause — the overly broad constants.TmpGhAwAgentDir path in collectArtifactPaths — rather than just filtering results downstream. Claude's debug log (claude-debug.log), which does live under that same directory, is preserved via the new GetDeclaredOutputFiles() override, so no diagnostic capability is lost.

Regression coverage (/tdd): TestAgentArtifactExcludesUserGeneratedDirectory asserts both that known files (MCP logs, sandbox agent logs, stdio log, proxy/audit dirs) remain in the upload section and that the bare /tmp/gh-aw/agent/ directory is absent — a solid positive/negative pair that guards against regression. TestGetEngineArtifactPaths_ClaudeDebugLog was correctly updated to reflect Claude's new declared output rather than deleted outright.

Consistency check: Verified no other in-repo workflow (e.g. ab-testing-advisor.md's experiment state file) depends on this artifact path for state that isn't otherwise captured — pick_experiment.cjs actually writes to /tmp/gh-aw/experiments/, not under /agent/, so no functional workflows appear to rely on the removed path. mkdir -p for TmpGhAwAgentDir in claude_engine.go's PathSetup is retained (still needed to create the debug-log directory), so no runtime step is broken.

Nit: The (nolint/redacted):largefunc additions on collectArtifactPaths / generatePostAgentCollectionAndUpload are pre-existing large functions gaining a suppression comment as a side effect of this diff — worth confirming CI lint actually requires this (harmless either way, just flagging as PR-generated noise unrelated to the artifact-path fix itself).

No blocking issues found; approving.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

github.com/ghapi
github.com

[!TIP]
github.com/ghapi is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding github.com/ghapi to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to github.com/ghapi:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com/ghapi"
    - "github.com"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 69.3 AIC · ⌖ 15.7 AIC · ⊞ 10.3K
_{Comment /matt to run again}

pelikhan · 2026-09-08T02:40:27Z

@copilot fix https://github.com/github/gh-aw/actions/runs/34178450551/job/101912927135

…aging Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-08T02:54:55Z

@copilot fix https://github.com/github/gh-aw/actions/runs/34178450551/job/101912927135

Fixed the test failure and updated WASM golden fixtures in commit 7892c24.

gh-aw-bot · 2026-09-08T04:04:45Z

@copilot the previous failing test/golden issue appears fixed, but this PR is still blocked. Please run the pr-finisher skill, refresh the branch if needed, and request another review so maintainers can re-evaluate the current head.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 45.4 AIC · ⌖ 8.71 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

pelikhan · 2026-09-08T04:21:34Z

@copilot fix https://github.com/github/gh-aw/actions/runs/34185716238/job/101935194675#step:7:1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-09-08T04:32:37Z

@copilot fix https://github.com/github/gh-aw/actions/runs/34185716238/job/101935194675#step:7:1

Fixed the Printf format specifier error in pkg/cli/audit_command.go (changed %s to %d for components.JobID) in commit a16a042.

github-actions · 2026-09-08T15:39:29Z

🎉 This pull request is included in a new release.

Release: v0.88.7

Restrict agent artifact contents

b2f3617

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Sep 8, 2026

Copilot AI requested a review from pelikhan September 8, 2026 01:58

Copilot created this pull request from a session on behalf of pelikhan September 8, 2026 01:58 View session

Copilot finished work on behalf of pelikhan September 8, 2026 01:58

pelikhan marked this pull request as ready for review September 8, 2026 01:58

Copilot AI balanced review requested due to automatic review settings September 8, 2026 01:58

Copilot started reviewing on behalf of pelikhan September 8, 2026 01:59 View session

github-actions Bot mentioned this pull request Sep 8, 2026

[aw] Ponytail Reviewer produced no safe outputs #59337

Closed

github-actions Bot added the needs-review label Sep 8, 2026

github-actions Bot reviewed Sep 8, 2026

View reviewed changes

Copilot AI reviewed Sep 8, 2026

View reviewed changes

github-actions Bot approved these changes Sep 8, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 8, 2026

[pr-sous-chef] PR Sous Chef run report #59322

Closed

Copilot started work on behalf of pelikhan September 8, 2026 02:41 View session

Fix unit test and update WASM golden fixtures for agent artifact pack…

7892c24

…aging Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 8, 2026 02:55

Merge branch 'main' into copilot/update-agent-artifact-packaging

5cb41cd

Copilot started work on behalf of gh-aw-bot September 8, 2026 04:05 View session

Copilot finished work on behalf of gh-aw-bot September 8, 2026 04:13

Copilot AI requested a review from gh-aw-bot September 8, 2026 04:13

Copilot started work on behalf of pelikhan September 8, 2026 04:22 View session

Fix Logger.Printf format specifier for JobID in audit_command.go

a16a042

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan September 8, 2026 04:32

pelikhan merged commit 844fe69 into main Sep 8, 2026
31 checks passed

pelikhan deleted the copilot/update-agent-artifact-packaging branch September 8, 2026 04:45

github-actions Bot mentioned this pull request Sep 9, 2026

Smoke Test: MAI-Code-1-Flash - 34293340851 #59556

Closed

		@@ -43,11 +43,6 @@ func (c Compiler) collectArtifactPaths(data WorkflowData, engine CodingAgentEn
		// before agent execution) so it is available in the agent artifact for post-run inspection.
		paths = append(paths, constants.PreAgentAuditFilePath.String())

Conversation

Copilot AI commented Sep 8, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Uh oh!

pelikhan commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

gh-aw-bot commented Sep 8, 2026

Uh oh!

pelikhan commented Sep 8, 2026

Uh oh!

Copilot AI commented Sep 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Sep 8, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading

github-actions Bot commented Sep 8, 2026 •

edited

Loading