Skip to content

[q] pr-sous-chef: approve CWI workflow runs alongside CGO/CJS #54629

Closed
#54633
Closed
[q] pr-sous-chef: approve CWI workflow runs alongside CGO/CJS#54629
#54633
Assignees
pelikhancopilot-swe-agent
Labels
agentic-workflowsautomationworkflow-optimization

Description

@github-actions
github-actions
bot
opened on Aug 21, 2026

Q Workflow Optimization Report

Issue Found

PR Sous Chef (.github/workflows/pr-sous-chef.md)

  • Requested via /q comment on issue Fix two CodeQL alerts in pkg/workflow: allocation overflow and unsafe JS quoting #54574: after Copilot finishes a round of review-feedback fixes, PRs can idle with action_required checks waiting on cgo.yml, cjs.yml, and/or CWI.yml (the Go/JS/Windows CI workflows requiring maintainer approval to run).
  • pr-sous-chef already had logic to detect and approve action-required cjs.yml/cgo.yml runs (using the AWI_MAINTENANCE_TOKEN maintenance secret, same token used for its nudge comments) but was missing CWI.yml (Windows CI) from the allowlist, so Windows-only action-required runs were left stuck.
Changes Made

.github/workflows/pr-sous-chef.md

  • Added CWI.yml to the approve-workflow-run.allowed-workflows safe-output configuration (alongside existing cjs.yml, cgo.yml).
  • Updated the run-approval instructions and the gh run list filter query to also match .github/workflows/CWI.yml.
  • Updated surrounding comments/skip-logic prose (bookkeeping counters, nudge-suppression rules) to reference CJS/CGO/CWI consistently.
  • No change to the AWI_MAINTENANCE_TOKEN usage — it already backs both add-comment and approve-workflow-run safe outputs, matching the maintenance-token requirement from the request.

Expected Improvements

  • pr-sous-chef will now auto-approve action-required Windows CI (CWI.yml) runs in addition to Go (cgo.yml) and JS (cjs.yml) runs, using the same maintenance token already configured, unblocking idling PRs waiting only on maintainer test approval.

Validation

Compiled successfully with the gh-aw compile tool (pre-built binary, since the repo's go.mod toolchain requirement could not be downloaded in this sandbox):

  • ✅ pr-sous-chef

Note: .lock.yml is intentionally excluded from this PR and will be regenerated automatically after merge.

Warning

Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files. A human must create the pull request manually.

Protected files

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission.

Create the pull request manually 
# Download the patch from the workflow run
gh run download 32529700625 -n agent -D /tmp/agent-32529700625

# Create a new branch
git checkout -b q/pr-sous-chef-cwi-approval-65c3c0ccf560d8bb main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-32529700625/aw-q-pr-sous-chef-cwi-approval.patch

# Push the branch and create the pull request
git push origin q/pr-sous-chef-cwi-approval-65c3c0ccf560d8bb
gh pr create --title '[q] pr-sous-chef: approve CWI workflow runs alongside CGO/CJS' --base main --head q/pr-sous-chef-cwi-approval-65c3c0ccf560d8bb --repo github/gh-aw

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

🎩 Equipped by Q · auto · 65.2 AIC · ⌖ 21.9 AIC · ⊞ 12.2K · ◷
Comment /q to run again

  • expires on Aug 23, 2026, 1:52 PM UTC-08:00

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

agentic-workflowsautomationworkflow-optimization

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions