feat: add weekly sbx/gVisor documentation updater workflow - #6333
Merged
Conversation
Adds an agentic workflow that runs weekly (and on demand) to keep docs/sbx-integration.md and docs/gvisor-integration.md accurate. It fetches the latest upstream Docker Sandboxes and gVisor documentation, reviews repo source changes from the last 7 days, and opens a single PR (restricted to the two docs) with any corrections, or noops. Compiled with gh aw v0.82.12 (latest pre-release). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23717692-af7a-4e03-a156-5b696c3f01bd
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a weekly agentic workflow to reconcile sbx and gVisor integration documentation with upstream sources and repository changes.
Changes:
- Adds scheduled and manual documentation review.
- Restricts PR output to two integration docs.
- Includes the compiled workflow lock file.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/sbx-gvisor-doc-updater.md |
Defines the updater’s configuration and instructions. |
.github/workflows/sbx-gvisor-doc-updater.lock.yml |
Contains the generated GitHub Actions workflow. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Medium
Comment on lines
+447
to
+450
| - name: Checkout repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| persist-credentials: false |
Collaborator
Author
There was a problem hiding this comment.
Fixed in 8ad027d: added a source-level steps: hook that runs git fetch --prune --unshallow before agent execution (mirroring doc-maintainer.md), so the prompt's git log --since="7 days ago" sees the full window. Recompiled the lock file.
| Also review changes merged in the **last 7 days** that touch these areas, so the docs reflect recent work: | ||
|
|
||
| ```bash | ||
| git log --since="7 days ago" --oneline -- src/container-runtime.ts src/sbx-manager.ts src/commands/main-action.ts src/services/agent-service.ts src/topology.ts |
Collaborator
Author
There was a problem hiding this comment.
Fixed in 8ad027d: the recent-change scan now includes src/services/agent-environment/tool-specific-environment.ts and src/commands/validators/security-mode.ts.
- Add a source-level unshallow step so the agent's 'git log --since= "7 days ago"' can inspect the full 7-day window rather than only the tip commit (actions/checkout defaults to depth 1). - Include src/services/agent-environment/tool-specific-environment.ts and src/commands/validators/security-mode.ts in the recent-change scan, since both are key files cited by the target docs. Recompiled with gh aw v0.82.12 (latest pre-release); npm test passes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23717692-af7a-4e03-a156-5b696c3f01bd
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
This was referenced Jul 18, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a scheduled agentic workflow,
sbx-gvisor-doc-updater, that keeps the two integration docs accurate:docs/sbx-integration.md(Docker Sandboxes /sbx)docs/gvisor-integration.md(gVisor /runsc)How it works
21 2 * * 1) plusworkflow_dispatch. Askip-if-matchguard avoids stacking a second open PR.web-fetch— the current Docker Sandboxes pages (docs.docker.com/ai/sandboxes/*) and gVisor architecture pages (gvisor.dev/docs/architecture_guide/*).container-runtime.ts,sbx-manager.ts,main-action.ts,agent-service.ts,topology.ts, etc.) and reviews changes merged in the last 7 days viagit log.create-pull-requestrestricted to the two docs (allowed-files), ornoopwhen both are already accurate. The agent job is read-only; all writes go through safe outputs.Security / scope
contents: read,pull-requests: read,copilot-requests: write— no direct write scopes.bashis restricted to read-only git/inspection commands;editlimited in effect by theallowed-filesPR contract.defaults,github,docs.docker.com,gvisor.dev,*.gvisor.dev. (The compiler suggests thecontainersecosystem fordocs.docker.com, but that ecosystem covers image registries, not the docs site — the explicit FQDN is required.)Notes
gh awv0.82.12 (the latest pre-release); the generated.lock.ymlis included.markdownlintpasses on the workflow source.