[#347] 🤖 - 347 347 Develop - #347
Conversation
|
To preview the documentation for this pull request, visit the following URL:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #347 +/- ##
==========================================
- Coverage 92.56% 88.46% -4.11%
==========================================
Files 475 526 +51
Lines 8312 10243 +1931
Branches 1659 2272 +613
==========================================
+ Hits 7694 9061 +1367
- Misses 232 573 +341
- Partials 386 609 +223 🚀 New features to boost your workflow:
|
✨ Feature Actions
Debug log🚀 Happy coding! Made with ❤️ by vypdev/copilot |
Pull-request workflow runs for every workflow completionSeverity: medium Location: The new Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits. |
Unrelated or stale workflow results can block a pull requestSeverity: medium Location:
Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits. |
The description command bypasses actor authorizationSeverity: medium Location:
Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits. |
| types: [submitted, edited, dismissed] | ||
| check_suite: | ||
| types: [completed, rerequested] | ||
| workflow_run: |
There was a problem hiding this comment.
Pull-request workflow runs for every workflow completion
Severity: medium
Location: setup/workflows/copilot_pull_request.yml:10
The new workflow_run trigger has no workflows filter, so every workflow completion in the repository launches this Copilot workflow, including unrelated CI, credential-health, deployment, and potentially its own runs. This creates unnecessary queued executions and can repeatedly reconcile PR labels based on unrelated events.
Suggested fix:
Restrict workflow_run to explicitly supported workflow names, or move lifecycle reconciliation into a separate workflow with a precise event filter and self-trigger protection.
Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits.
| if (command.name === 'dismiss') return runDismissCommand(param, options, command, actorAuthorizationPort); | ||
| if (['review', 'findings', 'recheck'].includes(command.name)) return runReviewCommand(param, options, command); | ||
| if (command.name === 'fix') return undefined; | ||
| if (command.name === 'description') return runDescriptionCommand(param, options); |
There was a problem hiding this comment.
The description command bypasses actor authorization
Severity: medium
Location: src/application/usecases/comment_automation_command_workflow.ts:19
/copilot description is dispatched directly to invokeExplicit without consulting the supplied ActorAuthorizationPort, unlike dismiss, fix, and implement operations. Any commenter who can trigger the issue-comment workflow can therefore cause the bot to rewrite the pull-request body; in replace mode this can overwrite the complete existing description.
Suggested fix:
Require the same maintainer authorization check before invoking the explicit description update, and return a skipped result when the actor is not authorized.
Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits.
| if (inputs.eventName === 'check_suite') { | ||
| return { checks: readChecksEvidence(inputs.check_suite?.status, inputs.check_suite?.conclusion) }; | ||
| } | ||
| if (inputs.eventName === 'workflow_run') { |
There was a problem hiding this comment.
Unrelated or stale workflow results can block a pull request
Severity: medium
Location: src/application/policies/lifecycle_state_policy.ts:79
readLifecycleExternalEvidence converts every check_suite and workflow_run completion into success or failure without checking the workflow name, check identity, or head SHA. A failed unrelated workflow, or a failed run for an older commit, can therefore mark the current PR as blocked; successful unrelated runs can also move it to reviewing.
Suggested fix:
Accept evidence only from configured validation workflows/checks and verify that the reported head SHA matches the current pull-request head before changing lifecycle state.
Written by vypdev/copilot for commit 7a0dd7f89925297c304769de0f2d892f70826172. This will update automatically on new commits.
vypbot
added
state:changes-requested
state:awaiting-issue-author
and removed
state:ai-processing
labels
✨ Feature Actions
Debug log🚀 Happy coding! Made with ❤️ by vypdev/copilot |
Setup requires both runtime and model-provider credentialsSeverity: medium Location: The setup plan adds the agent runtime credential and the model-provider credential as independent mandatory requirements. However, authentication accepts either usable credential for providers such as Codex, and the setup collector aborts when any listed credential is missing. A valid setup with only one supported credential can therefore fail unnecessarily. Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits. |
Setup requires credentials for disabled workflowsSeverity: medium Location: Credential requirements are generated for every configured agent task without checking which features are enabled. Consequently, disabling workflows with the setup feature selection does not prevent their agent credentials from being requested and validated, so setup can fail because of secrets needed only by unused reviewer, fixer, release, or other roles. Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits. |
Custom model providers cannot complete setupSeverity: medium Location: For an unrecognized model provider, the setup plan generates a secret name such as Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits. |
| if (!requirements.has(name)) requirements.set(name, { name, kind, description, provider, model }); | ||
| }; | ||
| add('PAT', 'workflowPat', 'A separate GitHub token owned by the bot account. It is used by workflows at runtime.'); | ||
| for (const task of SETUP_AGENT_TASKS) { |
There was a problem hiding this comment.
Setup requires credentials for disabled workflows
Severity: medium
Location: src/application/policies/setup_configuration_plan.ts:75
Credential requirements are generated for every configured agent task without checking which features are enabled. Consequently, disabling workflows with the setup feature selection does not prevent their agent credentials from being requested and validated, so setup can fail because of secrets needed only by unused reviewer, fixer, release, or other roles.
Suggested fix:
Derive required agent credentials from the enabled features and only include credentials for workflows that will be installed, while retaining any explicitly shared credentials required by enabled workflows.
Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits.
| auth: 'bearer' | 'x-api-key' | 'query' | 'basic'; | ||
| } | ||
|
|
||
| function endpointFor(requirement: SetupCredentialRequirement): CredentialEndpoint | undefined { |
There was a problem hiding this comment.
Custom model providers cannot complete setup
Severity: medium
Location: src/infrastructure/setup_credential_validation_adapter.ts:86
For an unrecognized model provider, the setup plan generates a secret name such as <provider>_API_KEY, but the credential validation adapter has no endpoint for that provider and returns an unverifiable result. SetupCredentialsUseCase rejects every result that is not valid, so configurations using custom providers accepted elsewhere by the agent authentication policy cannot be provisioned through setup.
Suggested fix:
Allow explicitly configured custom or local providers to use an unverifiable credential path, or require a provider-specific validation endpoint before generating a credential requirement.
Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits.
| add('CURSOR_API_KEY', 'apiKey', 'Cursor API key used by the Cursor agent runtime.', 'cursor', agent.model); | ||
| continue; | ||
| } | ||
| if (agent.provider === 'opencode') add('OPENCODE_API_KEY', 'apiKey', 'OpenCode API key used by the OpenCode agent runtime.', 'opencode', agent.model); |
There was a problem hiding this comment.
Setup requires both runtime and model-provider credentials
Severity: medium
Location: src/application/policies/setup_configuration_plan.ts:81
The setup plan adds the agent runtime credential and the model-provider credential as independent mandatory requirements. However, authentication accepts either usable credential for providers such as Codex, and the setup collector aborts when any listed credential is missing. A valid setup with only one supported credential can therefore fail unnecessarily.
Suggested fix:
Represent alternative credentials as credential groups and require at least one usable credential, or align setup requirements with the provider authentication policy.
Written by vypdev/copilot for commit 5e99c194a17e7a282756e2aea2498baa2f85f8da. This will update automatically on new commits.
✨ Feature Actions
Debug log🚀 Happy coding! Made with ❤️ by vypdev/copilot |
3 participants
📌 Summary
Expands Copilot’s workflow and CLI capabilities with safer PR-description policies, comment-driven assistance, organization-scoped setup resources, credential diagnostics, lifecycle synchronization, and scheduled cleanup of inactive waiting issues.
🎯 Related Issues / Tickets
🧩 Scope of Changes
Added:
copilot doctorandcopilot reconcilecommands./copilotcommands and lifecycle evidence handling.Updated:
Removed:
setup/.env.Refactored:
🛠️ Technical Details
replace,append,preserve, anddisabledmodes. Append mode maintains a bounded Copilot-managed section while preserving human-authored content.🔍 How to Test
Install the pinned toolchain and run the quality gates:
Run repository validation:
Manually verify:
copilot setup --dry-runwith repository and organization resource options.copilot doctor, confirming credential values are never exposed.copilot reconcile --jsonagainst workflow drift./copilot description.🧪 Test Coverage
Coverage includes lifecycle replay, inactivity closure, setup and credential workflows, organization authorization, configuration migration, comment routing, CLI commands, repository adapters, architecture boundaries, and workflow contracts.
📸 Screenshots / Recordings (UI changes only)
Not applicable — this PR does not change a graphical user interface.
copilot-state-*tostate-*, with default labels changing fromcopilot:state:*tostate:*. Existing workflows using custom legacy inputs must migrate.setup/.env; credentials must be provided through the secure prompt or supported environment/CLI options.replaceremains the default behavior.🚀 Deployment Notes
Details:
Install the scheduled cleanup workflow through
copilot setupor copy it fromsetup/workflows/. It uses the existingPATSecret and optionalINACTIVITY_THRESHOLD_HOURSRepository Variable. Generated bundles are included in the change.🔒 Security Considerations
Setup validates scopes, visibility, credentials, and organization access. File-modifying comment requests require appropriate authorization. Credential health checks avoid exposing secret values, and the setup PAT placeholder file was removed.
📈 Performance Impact
The scheduled cleanup uses paginated issue scans every six hours and revalidates candidates before mutation. Existing event-driven paths retain their current behavior.
📝 Notes for Reviewers
Please review the lifecycle label migration, PR-description ownership modes, organization-scoped resource permissions, authorization checks, and stale-candidate revalidation in inactive issue cleanup. The generated
build/bundles are intentionally updated with the source changes.✅ Checklist
📚 Additional Context
This branch contains the accumulated develop-line changes covering configurable lifecycle and PR policies, setup hardening, comment-driven assistance, organization resource support, inactive issue cleanup, and pnpm-based onboarding.