chore(gh-aw): temporarily downgrade compiler to v0.87.1 - #1999
Merged
Conversation
Bypasses the external threat-detect binary (v0.5.1) that ships in v0.87.2+ and is affected by github/gh-aw-threat-detection#1014 (invalid_report_exhausted despite a successful threat_detection_result tool call). v0.87.1 predates the external-detector default-on switch (#54111) and uses the older inline copilot-prompt-based detection path instead, sidestepping the bug. This is a temporary measure — revert once gh-aw-threat-detection#1014 is fixed upstream. Known tradeoffs while on v0.87.1: - No agent job timeout-minutes guard (falls back to GH Actions' 360-minute default instead of the 90-minute cap added later) - Missing GH_AW_PR_HEAD_BASE_*/GH_AW_PR_HEAD_REPO plumbing for fork-PR-aware safe-outputs handling - Older security-hardened container images (gh-aw-firewall 0.28.1, mcpg v0.4.9, github-mcp-server v1.9.0) and misses v0.87.2-v0.87.10 safe-output validation/permission-derivation/credential-hardening fixes - OTLP telemetry env wiring removed (not configured in this repo, so no practical impact) Verified: v0.87.1 is not in gh-aw's compat.json blocklist, all 57 workflows recompile with 0 errors (same warning set as v0.87.10), and the mcp-scripts `ready-to-code-review` tool remains correctly registered (that fix predates v0.83.4 and is unaffected by this downgrade). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
the
medium_boom
Member
Author
|
@copilot resolve the merge conflicts in this pull request then run the make goals to compile and lint and commit the changes |
…ression-analysis # Conflicts: # .github/workflows/gh-aw-dependency-review.lock.yml # .github/workflows/gh-aw-issue-triage.lock.yml # .github/workflows/gh-aw-pr-labeler.lock.yml Co-authored-by: v1v <2871786+v1v@users.noreply.github.com>
Co-authored-by: v1v <2871786+v1v@users.noreply.github.com>
Contributor
Done in |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Downgrades the gh-aw compiler pin (
GH_AW_VERSION/GH_AW_BUILD_VERSION/GH_AW_COMPAT_VERSION) fromv0.87.10tov0.87.1inMakefile, and recompiles all workflow lock files.Fixes/addresses #1998
Why
Several agentic workflows (e.g.
gh-aw-pr-review.lock.yml, consumed byelastic/docs-buildervia@v0) are failing theirdetectionjob with:Upstream
github/gh-awv0.87.2enabled external threat detection by default (gh-aw#54111), switching thedetectionjob to an externalthreat-detect(v0.5.1) binary that has an open upstream bug (github/gh-aw-threat-detection#1014): it reportsinvalid_report_exhaustedeven after the model successfully callsthreat_detection_result.v0.87.1predates that switch and uses the older inline copilot-prompt detection path instead, sidestepping the bug entirely.Full rationale, investigation, and tradeoffs are documented in #1998.
Changes
Makefile: bumpGH_AW_VERSION/GH_AW_BUILD_VERSION/GH_AW_COMPAT_VERSION→v0.87.1.lock.ymlworkflows +.github/aw/actions-lock.jsonviamake compileKnown tradeoffs (temporary, see #1998 for details)
timeout-minutes: 90guard on theagentjob (falls back to GitHub's 360-min default)GH_AW_PR_HEAD_BASE_*/GH_AW_PR_HEAD_REPOfork-PR-aware safe-outputs plumbinggh-aw-firewall 0.28.1,mcpg v0.4.9,github-mcp-server v1.9.0) — missesv0.87.2–v0.87.10safe-output validation/permission/credential hardening fixesConfirmed NOT affected by this downgrade: the
mcp-scripts/ready-to-code-reviewtool (that rename landed upstream in March 2026, long beforev0.83.4) — verified present and correctly registered atv0.87.1.Validation
make compile— 57/57 workflows succeeded, 0 errors, same warning set asv0.87.10make lint— passed cleanv0.87.1is not in gh-aw'scompat.jsonblocklist (blocked range isv0.82.8–v0.85.3)Follow-up
Track
github/gh-aw-threat-detection#1014upstream and re-upgrade to a fixed gh-aw release once available, reverting this downgrade.