feat: add prompt-template.txt and prompt-import-tree.json to activation artifact#30465
Merged
Merged
Conversation
… output - In interpolate_prompt.cjs: write the raw template to prompt-template.txt before any processing, and write the import provenance tree to prompt-import-tree.json after runtime imports are resolved - In runtime_import.cjs: add optional parentTreeChildren parameter to processRuntimeImports to build an import tree with file provenance (macro, src, rawContent, optional, startLine, endLine, children) - Add tests for prompt-template.txt and prompt-import-tree.json in interpolate_prompt.test.cjs - Add tree-building tests in runtime_import.test.cjs" Agent-Logs-Url: https://github.com/github/gh-aw/sessions/971e2de0-25ca-445d-9970-bd7f33f1908f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add pre-rendered prompt template to artifact output for analysis
feat: add prompt-template.txt and prompt-import-tree.json to activation artifact
May 5, 2026
Collaborator
|
@copilot ensure the files are captured in the activation artifact |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds additional prompt-related activation artifacts to support downstream threat detection by enabling diffs between the raw template, runtime-import expansions, and the fully rendered prompt.
Changes:
- Extend
processRuntimeImportsto optionally build an import provenance tree (including nested imports and cache hits). - Update
interpolate_promptto persistprompt-template.txt(pre-processing) andprompt-import-tree.json(import provenance) alongsideprompt.txt. - Add unit tests covering import-tree construction and the new artifact outputs.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/runtime_import.cjs | Adds optional import-tree building to runtime import processing, including nested imports and cached import nodes. |
| actions/setup/js/runtime_import.test.cjs | Adds coverage for import-tree building behavior (single, nested, optional, cached, ordered imports). |
| actions/setup/js/interpolate_prompt.cjs | Writes prompt-template.txt before processing and emits prompt-import-tree.json after runtime imports resolve. |
| actions/setup/js/interpolate_prompt.test.cjs | Adds integration tests asserting the new artifact files are written and correctly populated. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 2
Comment on lines
+213
to
+217
| const importTree = { | ||
| version: 1, | ||
| template: content, | ||
| children: /** @type {import('./runtime_import.cjs').ImportTreeNode[]} */ [], | ||
| }; |
Comment on lines
+1151
to
+1155
| startLine: startLine ?? null, | ||
| endLine: endLine ?? null, | ||
| rawContent: cachedContent, | ||
| cached: true, | ||
| children: [], |
…vation artifact Add the two new aw-prompts files to the activation artifact upload step so they are available to downstream consumers (e.g. threat detection). Update golden test fixtures accordingly. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/34461233-1454-45ac-8a5c-92ea04e061e5 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 9146e68. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot review all comments |
…nsistency - Add local @typedef ImportTreeNode in interpolate_prompt.cjs to avoid cross-module JSDoc import type that TypeScript cannot resolve - Restructure treeNode creation to eliminate nullable variable, fixing TS18047 "parentTreeChildren is possibly null" error - Add rawImportCache (Map<string,string>) parameter to track raw pre-expansion content separately from the fully-expanded importCache; cached tree nodes now report the raw template as rawContent rather than the expanded output, making provenance consistent across occurrences - Add test asserting cached imports with nested content use the pre-expansion rawContent Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3e7dab45-05b5-4460-9b2a-02e82f054ea4 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Addressed both review comments in f053e85:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot merge main and recompile |
…endered-template-artifact # Conflicts: # .github/workflows/daily-cache-strategy-analyzer.lock.yml # .github/workflows/daily-fact.lock.yml # .github/workflows/daily-observability-report.lock.yml # .github/workflows/duplicate-code-detector.lock.yml # .github/workflows/grumpy-reviewer.lock.yml # .github/workflows/issue-arborist.lock.yml # .github/workflows/schema-feature-coverage.lock.yml # .github/workflows/smoke-call-workflow.lock.yml # .github/workflows/smoke-codex.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c417fec6-8abb-49f2-9bbf-869091551c5e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 96d57fb — merged main (resolved 9 lock file conflicts by accepting main, then recompiled), rebuilt the binary, and recompiled all 214 workflow lock files. Pre-PR validation passes. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Threat detection currently receives only the fully-rendered
prompt.txt, forcing heuristic analysis to distinguish trusted template content from untrusted runtime-interpolated content. This adds two new files toaw-prompts/so detection can diff template vs. rendered and analyse only interpolated segments.New artifact files
prompt-template.txtprompt-import-tree.json{{#runtime-import}}macro to its source file, raw content, and nested childrenprompt-import-tree.jsonschema{ "version": 1, "template": "<raw template before any expansion>", "children": [ { "macro": "{{#runtime-import .github/workflows/helper.md}}", "src": ".github/workflows/helper.md", "optional": false, "startLine": null, "endLine": null, "rawContent": "<file content before nested expansion>", "children": [ /* recursively nested imports */ ] } ] }Cached imports (deduped by
importCache) are recorded with"cached": trueand no children since the tree was already built on the first occurrence.Implementation
runtime_import.cjs—processRuntimeImportsgains an optionalparentTreeChildrenparameter (defaultnull). When provided, each resolved import pushes anImportTreeNodeinto the array; recursive calls receivetreeNode.children. No change to existing callers.interpolate_prompt.cjs— After readingprompt.txtand before any processing:prompt-template.txtverbatim to the same directoryprocessRuntimeImportswithimportTree.childrento populate provenanceprompt-import-tree.jsononce imports resolvecompiler_activation_job_builder.go— Both new files are explicitly listed in the activation artifact upload step paths so they are captured alongsideprompt.txtand available to downstream consumers (e.g. threat detection). All compiled lock files have been regenerated to include the new paths.