Add classification-labels input and add-labels safe output to Issue Triage by Copilot · Pull Request #1030 · elastic/ai-github-actions

Copilot · 2026-04-27T11:10:20Z

Add classification-labels input and add-labels safe output to Issue Triage
Create gh-aw-fragments/safe-output-add-labels.md reusable fragment
Refactor gh-aw-dependency-review.md to import the new fragment
Update README.md / docs/ and example.yml
Fix: add GH_AW_AGENT_OUTPUT env var to safe-output-add-labels.md fragment env: block
Fix: regenerate lock files via make compile (sync with fragment fix)
Fix: upgrade actions/github-script from v7 to v9 in safe-output-add-labels.md; recompile lock files

…ssue-triage Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/e09ad63a-2941-4150-8412-17cb4b5a6094 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

fr4nc1sc0-r4m0n · 2026-04-27T11:29:49Z

@copilot could make sense to create a fragment for the add-labels safe output to reuse this?

…ragment Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/0446c92c-b22e-4b12-a729-014201ceaced Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot · 2026-04-27T11:34:49Z

@copilot could make sense to create a fragment for the add-labels safe output to reuse this?

Done — created gh-aw-fragments/safe-output-add-labels.md (546a3a9) that encapsulates the add-labels: max: 3 config and the Pre-sanitize allowlist-filtering step. Both gh-aw-dependency-review.md and gh-aw-issue-triage.md now import this fragment instead of inlining the logic.

github-actions

Requesting changes: the new shared safe-output-add-labels fragment does not wire GH_AW_AGENT_OUTPUT into the sanitizer step, so allowlist filtering can be skipped depending on caller environment.

What is this? | From workflow: Trigger PR Review

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

github-actions · 2026-04-27T11:56:15Z

+    - name: Pre-sanitize labels from input allowlist
+      uses: actions/github-script@v7
+      env:
+        CLASSIFICATION_LABELS: ${{ inputs.classification-labels }}


GH_AW_AGENT_OUTPUT is used by this script (const outputPath = process.env.GH_AW_AGENT_OUTPUT;) but it isn’t wired into this step’s env, so this sanitizer can silently no-op when the variable isn’t already present in the job environment.

That defeats the allowlist filtering (classification-labels) and can let unfiltered add_labels operations reach safe-output processing.

Please pass the output path explicitly here (for example from steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT) so the fragment is self-contained and consistently enforces the allowlist.

@copilot address this comment #1030 (comment)

@copilot apply the changes proposed in this comment #1030 (comment)

Copilot · 2026-04-27T12:08:14Z

@copilot could make sense to create a fragment for the add-labels safe output to reuse this?

Already done — gh-aw-fragments/safe-output-add-labels.md (546a3a9) encapsulates the add-labels: max: 3 config and the Pre-sanitize allowlist-filtering step. Both gh-aw-dependency-review.md and gh-aw-issue-triage.md import this fragment instead of inlining the logic.

fr4nc1sc0-r4m0n · 2026-04-27T12:16:54Z

@copilot Address this issue in the fragment:

file: .github/workflows/gh-aw-fragments/safe-output-add-labels.md
line: 9
severity: HIGH
title: Pre-sanitize allowlist can silently no-op because required output-path env is not wired
description: The sanitizer reads process.env.GH_AW_AGENT_OUTPUT but this fragment only sets CLASSIFICATION_LABELS. If GH_AW_AGENT_OUTPUT is not injected by the caller, the step exits early and allowlist filtering is skipped entirely.
evidence: env: lacks GH_AW_AGENT_OUTPUT (line 9), while script immediately uses it (line 13) and returns on missing value (lines 14–17). This leaves add_labels unfiltered even when classification-labels is empty/invalid.
suggestion: Add GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} in the fragment env (or fail hard if missing).

Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/1d566878-3877-443f-8544-a4002ea92c83 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot · 2026-04-27T12:19:54Z

@copilot Address this issue in the fragment:

file: .github/workflows/gh-aw-fragments/safe-output-add-labels.md
...

Fixed in db3cc4a. Added GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }} to the env: block in both the fragment (safe-output-add-labels.md) and the compiled gh-aw-dependency-review.lock.yml. The issue triage lock already had it wired correctly.

fr4nc1sc0-r4m0n · 2026-04-27T12:32:07Z

@copilot fix the failing check https://github.com/elastic/ai-github-actions/actions/runs/24994619728/job/73188335080?pr=1030

Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/76c6bc70-a281-49f1-be2a-027ddcb9a5f2 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot · 2026-04-27T12:35:12Z

@copilot fix the failing check https://github.com/elastic/ai-github-actions/actions/runs/24994619728/job/73188335080?pr=1030

Fixed in 7b96fff. The CI was failing because the lock files were out of sync — I had manually edited them instead of regenerating via make compile. Installed the gh-aw compiler and ran make compile to correctly regenerate gh-aw-dependency-review.lock.yml, gh-aw-issue-triage.lock.yml, and trigger-issue-triage.yml from the updated fragment source.

v1v · 2026-04-27T14:23:00Z

+    max: 3
+  steps:
+    - name: Pre-sanitize labels from input allowlist
+      uses: actions/github-script@v7


@copilot use v9 here

Done in 0fa6131 — updated safe-output-add-labels.md to actions/github-script@v9 and recompiled the lock files. The v7 pin is now gone from both gh-aw-dependency-review.lock.yml and gh-aw-issue-triage.lock.yml.

…agment Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/f5181716-39d3-4aed-b4e5-ebc3ade08e06 Co-authored-by: v1v <2871786+v1v@users.noreply.github.com>

Done here #1030 (comment)

fr4nc1sc0-r4m0n · 2026-04-28T12:32:48Z

@copilot I want to modify the gh-aw-issue-triage agentic workflow to receive a custom ephemeral token to be used in the pull request labeling safe output to allow events being triggered by this labeling action.

Copilot · 2026-04-28T12:36:14Z

@copilot I want to modify the gh-aw-issue-triage agentic workflow to receive a custom ephemeral token to be used in the pull request labeling safe output to allow events being triggered by this labeli...

This is already implemented in the current PR. The optional GH_AW_GITHUB_TOKEN secret is declared in gh-aw-issue-triage.md and is wired as the github-token for the safe outputs handler in the compiled lock file (github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}). When provided (e.g. a GitHub App token), labels applied via add_labels will use that token, allowing downstream label-triggered workflows to fire. When omitted, it falls back to GITHUB_TOKEN. The docs at docs/workflows/gh-agent-workflows/issue-triage.md explain this explicitly.

fr4nc1sc0-r4m0n · 2026-04-30T12:13:52Z

It's working fine:

[oblt-aw][security] SEC-032 — findings (2026-04-30) oblt-aw#753

I think we can merge this one @v1v

fr4nc1sc0-r4m0n

LGTM

Initial plan

8a21b12

Copilot AI assigned Copilot and fr4nc1sc0-r4m0n Apr 27, 2026

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 11:10 View session

Copilot AI linked an issue Apr 27, 2026 that may be closed by this pull request

Issue Triage allows issue labelling #1029

Closed

Add classification-labels input and add-labels safe output to gh-aw-i…

f61235d

…ssue-triage Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/e09ad63a-2941-4150-8412-17cb4b5a6094 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add classification-labels input parameter to issue triage~~ Add classification-labels input and add-labels safe output to Issue Triage Apr 27, 2026

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 11:27

Copilot AI requested a review from fr4nc1sc0-r4m0n April 27, 2026 11:27

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 11:30 View session

Extract add-labels safe output into reusable safe-output-add-labels f…

546a3a9

…ragment Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/0446c92c-b22e-4b12-a729-014201ceaced Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 11:38

fr4nc1sc0-r4m0n marked this pull request as ready for review April 27, 2026 11:45

github-actions Bot added the medium_boom Medium PR blast radius; likely benefits from human review label Apr 27, 2026

github-actions Bot previously requested changes Apr 27, 2026

View reviewed changes

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 11:59 View session

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:00

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:07 View session

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:08

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:17 View session

fix: wire GH_AW_AGENT_OUTPUT env var in safe-output-add-labels fragment

db3cc4a

Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/1d566878-3877-443f-8544-a4002ea92c83 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:20

Copilot started work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:32 View session

fix: regenerate lock files via make compile (sync with fragment fix)

7b96fff

Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/76c6bc70-a281-49f1-be2a-027ddcb9a5f2 Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 27, 2026 12:38

v1v reviewed Apr 27, 2026

View reviewed changes

Copilot started work on behalf of v1v April 27, 2026 14:23 View session

fix: upgrade actions/github-script to v9 in safe-output-add-labels fr…

0fa6131

…agment Agent-Logs-Url: https://github.com/elastic/ai-github-actions/sessions/f5181716-39d3-4aed-b4e5-ebc3ade08e06 Co-authored-by: v1v <2871786+v1v@users.noreply.github.com>

Copilot AI requested a review from v1v April 27, 2026 14:26

Copilot finished work on behalf of v1v April 27, 2026 14:26

Copilot started work on behalf of fr4nc1sc0-r4m0n April 28, 2026 12:32 View session

Copilot finished work on behalf of fr4nc1sc0-r4m0n April 28, 2026 12:38

github-actions Bot mentioned this pull request Apr 30, 2026

[aw] No-Op Runs #1039

Open

fr4nc1sc0-r4m0n approved these changes Apr 30, 2026

View reviewed changes

fr4nc1sc0-r4m0n enabled auto-merge (squash) April 30, 2026 12:34

v1v approved these changes Apr 30, 2026

View reviewed changes

fr4nc1sc0-r4m0n merged commit d1545d9 into main Apr 30, 2026
32 of 33 checks passed

fr4nc1sc0-r4m0n deleted the copilot/add-classification-labels-input branch April 30, 2026 13:04

github-actions Bot mentioned this pull request May 1, 2026

[project-summary] Project Summary - 2026-05-01 #1054

Closed

This was referenced May 4, 2026

Issue Triage can use Ephemeral Token #1024

Closed

feat(issue-triage): expose GH_AW_GITHUB_TOKEN in workflow_call contract #1026

Closed

This was referenced May 4, 2026

[product-manager-impersonator] Single-workflow compile target #1063

Open

Mint Ephemeral Tokens #1067

Open

[product-manager-impersonator] Secret contract parity lint for reusable workflows #1076

Open

github-actions Bot mentioned this pull request May 19, 2026

[bug-hunter] Uncommenting Issue Triage label config creates duplicate YAML with key #1135

Closed

Uh oh!

Conversation

Copilot AI commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fr4nc1sc0-r4m0n commented Apr 27, 2026

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

fr4nc1sc0-r4m0n Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

fr4nc1sc0-r4m0n Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

fr4nc1sc0-r4m0n commented Apr 27, 2026

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

fr4nc1sc0-r4m0n commented Apr 27, 2026

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

v1v Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

fr4nc1sc0-r4m0n commented Apr 28, 2026

Uh oh!

Copilot AI commented Apr 28, 2026

Uh oh!

fr4nc1sc0-r4m0n commented Apr 30, 2026

Uh oh!

fr4nc1sc0-r4m0n left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 27, 2026 •

edited

Loading