Repository navigation
chore: sync actions from gh-aw@v0.92.0 - #275
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive publication and authorization changes have unresolved issues and require human validation.
5 open findings
What changed in this PR
Syncs the action runtime from gh-aw v0.92.0, updating workflow execution, safe outputs, and work queues.
Changes:
- Adds transport integrity checks around privileged Git operations.
- Updates enterprise host support, queue credentials, and summaries.
- Adds model-selection verification and improves session metadata and failure reporting.
| File | Description |
|---|---|
setup/sh/collect_usage_artifact_files.sh |
Collects runtime metadata. |
setup/setup.sh |
Copies additional runtime dependencies. |
setup/session_parsers.go |
Embeds additional parser dependencies. |
setup/md/work_queue_reconciliation_summary.md |
Adds reconciliation summary template. |
setup/md/model_not_supported_error.md |
Explains integration-specific model availability. |
setup/js/work_queue_summary.cjs |
Adjusts summary spacing. |
setup/js/work_queue_summary_renderer.cjs |
Makes queue summaries collapsible. |
setup/js/work_queue_store_checks.cjs |
Supports immutable fixture identifiers. |
setup/js/work_queue_resource_scope.cjs |
Uses configured server host. |
setup/js/work_queue_resource_scope_checks.cjs |
Checks enterprise resource authorization. |
setup/js/work_queue_provisioning_checks.cjs |
Checks host dependency copying. |
setup/js/work_queue_policy.cjs |
Validates configured projector hosts. |
setup/js/work_queue_policy_checks.cjs |
Checks projector host validation. |
setup/js/work_queue_issue_api.cjs |
Uses configured issue host. |
setup/js/work_queue_host.cjs |
Adds server/API host validation. |
setup/js/work_queue_graphql_adapter_checks.cjs |
Checks enterprise verification targets. |
setup/js/work_queue_graph.cjs |
Validates configured resource hosts. |
setup/js/work_queue_graph_checks.cjs |
Checks graph resource hosts. |
setup/js/work_queue_effect_resource.cjs |
Checks API endpoint trust. |
setup/js/work_queue_effect_client.cjs |
Binds GraphQL targets to hosts. |
setup/js/work_queue_effect_client_checks.cjs |
Checks foreign-host rejection. |
setup/js/work_queue_dispatch.cjs |
Updates submission policy lookup. |
setup/js/work_queue_control_adapter.cjs |
Separates publisher client credentials. |
setup/js/work_queue_control_adapter_checks.cjs |
Checks publisher credential routing. |
setup/js/work_queue_claim_scope.cjs |
Uses configured verification host. |
setup/js/upload_artifact.cjs |
Uses configured artifact authority host. |
setup/js/unified_session.cjs |
Prefers runtime workflow metadata. |
setup/js/unified_session_payload.cjs |
Normalizes model-selection metadata. |
setup/js/types/unified_session.d.ts |
Adds model-selection types. |
setup/js/transport_integrity.cjs |
Adds snapshots, guards, and cleanup. |
setup/js/safe_outputs_handlers.cjs |
Updates checkout and transport selection. |
setup/js/resolve_transport_paths.cjs |
Rejects ambiguous transport namespaces. |
setup/js/resolve_model_alias.cjs |
Distinguishes catalog and availability failures. |
setup/js/repo_helpers.cjs |
Adds checkout identity helpers. |
setup/js/push_to_pull_request_branch.cjs |
Guards transport reads and publication. |
setup/js/push_signed_commits.cjs |
Checks integrity before remote writes. |
setup/js/parse_token_usage.cjs |
Publishes runtime metadata snapshots. |
setup/js/package.json |
Adds queue performance test command. |
setup/js/normalize_branch_name.cjs |
Preserves empty normalization results. |
setup/js/model_attribution.cjs |
Accounts for observed model selection. |
setup/js/log_parser_bootstrap.cjs |
Avoids redundant unified-session wrapping. |
setup/js/handle_agent_failure.cjs |
Classifies unavailable configured models. |
setup/js/git_patch_utils.cjs |
Rejects unusable transport branch names. |
setup/js/generate_git_bundle.cjs |
Shares branch-name validation. |
setup/js/finish_work_queue_claim.cjs |
Renders reconciliation from template. |
setup/js/extra_empty_commit.cjs |
Guards CI-trigger publication. |
setup/js/eslint_factory_native.test_helpers.cjs |
Adds native API test helpers. |
setup/js/error_recovery.cjs |
Prevents integrity-error retries. |
setup/js/create_pull_request.cjs |
Guards transport application and publication. |
setup/js/create_or_update_pull_request.cjs |
Checks integrity around PR creation. |
setup/js/copilot_model_selection.cjs |
Observes invocation-specific model selection. |
setup/js/copilot_harness.cjs |
Enforces model and session verification. |
setup/js/claude_harness.cjs |
Applies settings from environment. |
setup/js/cancel_work_queue_closed_issue.cjs |
Uses configured cancellation target host. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+86
to
+89
| const fd = fs.openSync(file, "r"); | ||
| let bytesRead; | ||
| try { | ||
| bytesRead = fs.readSync(fd, content, 0, content.length, offset); |
Comment on lines
+262
to
+265
| const fd = fs.openSync(infoPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW); | ||
| let snapshot; | ||
| try { | ||
| snapshot = fs.readFileSync(fd); |
| } | ||
| } | ||
| } | ||
| return ""; |
Comment on lines
+420
to
+424
| const summary = renderTemplateFromFile(getPromptPath("work_queue_reconciliation_summary.md"), { | ||
| authorized_claims: states.filter(state => state.authorized).length, | ||
| unauthorized_claims: states.filter(state => !state.authorized).length, | ||
| }); | ||
| return summary.trimEnd() + "\n\n\n"; |
| } else { | ||
| server.debug("create_pull_request: resolved target matches workflow repository; no cross-repo checkout needed"); | ||
| } | ||
| if (targetIsSideRepo && !repoCwd) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync of actions from gh-aw at
v0.92.0.