Preserve repo-memory files during safe-output validation

[Copilot]

push_repo_memory validation could delete files excluded by persistence filters, leaving the working directory empty while reporting success. Validation should measure eligible changes without removing the agent’s files.

• Validation and staging: Apply extension and glob filters to the validation set and stage only eligible paths; leave excluded files untouched.
• Regression coverage: Verify excluded files—including legacy-path copies—remain unchanged after validation.

if (!isEligibleFile(relPath)) {
  continue; // Exclude from validation without deleting from disk
}

• Fixes [deep-report] push_repo_memory safe-output silently wipes the repo-memory working directory instead of validating it (data loss) #65458

[github-actions]

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Generated by Ponytail Reviewer for #65462

[github-actions]

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[Copilot]

Copilot review overview

🟡 Changes recommended

Excluded files still affect formatting, custom validation, and patch-size measurement when already staged.

Review effort: Balanced
Findings: 3

Open (3)

• Excluded JSON files are formatted before eligibility filtering · New
• Custom validation includes excluded files · New
• Patch size checks include staged excluded files · New

What changed in this PR

Addresses #65458 by replacing destructive repo-memory filtering with eligibility checks during safe-output validation.

Changes:

• Filters file counting and staging without deleting excluded files.
• Adds preservation regressions, including legacy-path copies.

File	Description
actions/​setup/​js/​safe_outputs_handlers.test.cjs	Verifies excluded files survive validation.
actions/​setup/​js/​safe_outputs_handlers.cjs	Applies eligibility checks instead of deleting files.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Updated formatJSONFiles to receive the eligibility predicate and skip excluded JSON before reading or rewriting it. Regression coverage confirms excluded JSON remains byte-for-byte unchanged while eligible JSON formats successfully. Fixed in 1371073.

[Copilot]

Custom validation now runs on a temporary view containing only eligible files, preserving paths relative to the memory root and the validator's read-only check. Added coverage for malformed excluded JSON and read-only behavior. Fixed in 1371073.

[Copilot]

Patch sizing now scopes git diff --cached to literal eligible pathspecs, including eligible files already staged, and returns zero when none qualify without changing excluded index entries. Added a pre-staged excluded-file regression. Fixed in 1371073.

[github-actions]

Comment Memory

reviewed_at: 2026-10-04T03:22:52Z
review_event: REQUEST_CHANGES
top_themes:
  - excluded repo-memory files still affect format_json/custom validation
files_reviewed:
  - actions/setup/js/safe_outputs_handlers.cjs
  - actions/setup/js/safe_outputs_handlers.test.cjs
comment_count: 1

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 52.1 AIC · ⌖ 7.18 AIC · ⊞ 19.4K · ◷
_{Comment /review to run again}

[github-actions]

Request changes

The preflight now preserves ineligible repo-memory files, but it still lets those excluded files participate in later validation phases, so push_repo_memory can fail or rewrite content that the eventual push would ignore.

Blocking theme

allowed_extensions/file_glob are now applied to the file-count and staging pass only. formatJSONFiles(...) still walks the whole directory, and validation.script still receives the full memoryDir. In practice that means a legacy or sidecar file outside the persistence filter can still be reformatted or make custom validation fail, even though the later push path would drop it.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 52.1 AIC · ⌖ 7.18 AIC · ⊞ 19.4K
_{Comment /review to run again}

[github-actions]

This still lets excluded files change or fail validation, because only the size/count scan is filtered while formatJSONFiles(...) and the custom validator still walk the entire memory directory.

💡 Apply the same persistence filter to every validation phase

With this patch, a file excluded by allowed_extensions or file_glob is preserved on disk, but it is still visible to later validation steps. format_json will still reformat excluded *.json files, and validation.script still receives the full memoryDir, so it can fail on files the later push would silently drop. That means push_repo_memory can still reject or mutate content outside the effective persistence set.

A safe fix is to keep the original files in place, but run formatting/custom validation against the same filtered view used for counting and staging.

[Copilot]

All persistence filters now apply to formatting, custom validation, size/count checks, patch measurement, and staging; excluded files remain untouched in the working tree and index. Fixed in 1371073.

[github-actions]

Reviewed with impeccable critique/audit lens (closest fit for this bug_fix/refactor_cleanup change, applied as a correctness/robustness review since there's no UI surface).

What changed: push_repo_memory validation no longer deletes ineligible files (via filterIneligibleMemoryFiles) before scanning. Instead, isMemoryFileEligible is applied inline during the scanDir walk to exclude ineligible files from the counted/validated set, and only eligible + already-tracked-eligible paths are staged with git add --sparse --all -- :(literal).... This matches the PR's stated goal: validation measures eligible changes without destructively removing files from the agent's working directory.

Verification performed:

• Walked the diff against memory_file_eligibility.cjs and push_repo_memory.cjs to confirm the push job's own filtering (filterIneligibleMemoryFiles there) is unchanged and still the single place where ineligible files are actually dropped before a push — so excluded files remain in the agent's checkout but are still correctly never pushed.
• Confirmed git ls-files -z + explicit :(literal) pathspecs correctly stage both new eligible files and already-tracked eligible files, and that an untracked/deleted file under an eligible pattern is handled consistently (git add --all tracks deletions too).
• Ran actions/setup/js/safe_outputs_handlers.test.cjs — all push_repo_memory tests pass, including the new regression test asserting mixed-eligibility directories keep excluded files on disk after validation.

No blocking or high-signal issues found; the change is well-scoped, the explanation is clear, and test coverage directly targets the described bug (#65458). Nothing actionable to flag inline.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet50 · 143.6 AIC · ⌖ 13.1 AIC · ⊞ 8.1K

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (actions/setup/js/safe_outputs_handlers.cjs:1846): With format_json: true and file_glob: "state.json", an excluded legacy.json is still processed by formatJSONFiles(memoryDir, maxFileSize) before eligibility is checked. It can be rewritten or cause validation to fail if its formatted size exceeds the limit. Pass the eligibility predicate into the formatter and skip excluded files before reading or writing them. Add a regression asserting excluded JSON remains byte-for-byte unchanged and does not affect validation. - Preserve repo-memory files during safe-output validation #65462 (comment)
3. Review (actions/setup/js/safe_outputs_handlers.cjs:1901): This filters the built-in size/count checks, but runCustomMemoryValidation still receives the unfiltered memoryDir. With file_glob: "state.json", a validator parsing all root-level JSON files also reads an excluded malformed legacy.json and can reject valid memory. The push job removes excluded files before invoking the validator, so the two paths now validate different content. Run custom validation against an eligible-only temporary view while preserving the live files and the validator's relative-path and read-only behavior. - Preserve repo-memory files during safe-output validation #65462 (comment)
4. Review (actions/setup/js/safe_outputs_handlers.cjs:1979): Restricting git add leaves previously staged excluded files in the index. getStagedPatchDiffSizeBytes then runs unrestricted git diff --cached, so an excluded file staged by the agent can exceed max_patch_size and reject otherwise valid memory. Scope patch measurement to eligible paths, returning zero when there are none, without changing excluded files or their index entries. Add regression coverage for a previously staged excluded file. - Preserve repo-memory files during safe-output validation #65462 (comment)
5. Review (actions/setup/js/safe_outputs_handlers.cjs:1846): This still lets excluded files change or fail validation, because only the size/count scan is filtered while formatJSONFiles(...) and the custom validator still walk the entire memory directory. - Preserve repo-memory files during safe-output validation #65462 (comment)
6. Fix failing check agent (FAILURE): https://github.com/github/gh-aw/actions/runs/37173732058/job/111352215721.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: fcca3aa
Sous-chef work: 34f38971738f6a752a646bd7797a6c8d47fb096e4eb6f91e946a91255433c8c4 3611649bac49ae0e75260316713b131a6d18335a367e1793d3362214db911708 52262a386f74e115b6d8ab8cf9b04e81b3632cb75d24da5125fe94cd08046d0f b566c98e57ec6a6bc8707578e6bf2960e9d36600a0dd07a6781e6ddd1c4558b5 cb4bada102f8e0d85e144b94e0be1d91df58783d8e3a1d83356ec75da5a8c8b3
Sous-chef state: 08632c9653682d9da443a0fe99bb69560d7612a0add8ce10322d214b2313bca0

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 8.35 AIC · ⌖ 13.4 AIC · ⊞ 3K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.91.0