Add inline YAML fix example to persist-credentials compile error by Copilot · Pull Request #54957 · github/gh-aw

Copilot · 2026-08-23T01:43:32Z

Strict-mode compile errors (and non-strict warnings) for missing persist-credentials: false told users what to fix but not how, forcing a context switch to docs mid-build-failure to recall the exact YAML syntax.

Changes

pkg/workflow/imported_steps_validation.go: append a copy-pasteable YAML snippet to the error/warning message emitted by validateCheckoutPersistCredentials, so the fix can be applied and recompiled immediately.

actions/checkout step(s) without 'persist-credentials: false' detected in the agent job: 'Checkout'.
Without this setting the git token is stored in .git/config and leaked to the agent.
Add 'persist-credentials: false' to the 'with:' block of each checkout step, for example:
      # example (keep your existing "uses:" ref):
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
See: https://github.github.com/gh-aw/reference/steps/

The example is annotated as illustrative to avoid implying users should change their pinned uses: ref when copying the snippet.

Fixes [deep-report] Add inline YAML fix example to persist-credentials compile error #54942

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-23T01:53:56Z

 	}

+	const persistCredentialsExample = `      # example (keep your existing "uses:" ref):
+      - uses: actions/checkout@v4


@copilot resolve the current release of checkout and insert in message

Updated to the current pinned release: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 (matches the repo's pkg/actionpins/data/action_pins.json entry and how it's pinned in compiled .lock.yml workflows).

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-23T02:07:20Z

 	}

+	const persistCredentialsExample = `      # example (keep your existing "uses:" ref):
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


@copilot resolve actions/checkout with a action pin manager and use the version ref only in the example

Updated in 5e9... — now resolves actions/checkout's current pin via actionpins.GetLatestActionPinByRepo("actions/checkout") and uses only the version ref (e.g. actions/checkout@v7.0.1) in the example, falling back to v4 if resolution fails.

Correction: the commit is e6e792e, not the placeholder hash in my previous reply. It resolves actions/checkout's current pin via actionpins.GetLatestActionPinByRepo("actions/checkout") and uses only the version ref (e.g. actions/checkout@v7.0.1) in the example, falling back to v4 if resolution fails.

… in example Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-23T02:18:36Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. This PR only modified pkg/workflow/imported_steps_validation.go (production code). Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-23T02:18:36Z

✅ Ponytail Reviewer completed successfully!

Lean already. Ship. Diff is a small, direct change (resolve action pin, format example string, append to message) with no speculative abstractions, unused flexibility, or reinvented stdlib functionality.

Generated by Ponytail Reviewer for #54957

github-actions · 2026-08-23T02:18:38Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-23T02:18:41Z

✅ PR Code Quality Reviewer completed the code quality review.

Reviewed PR #54957: no actionable changed-line issues found, so no review comments or final review submission were needed.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-23T02:18:43Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories (13 additions detected, threshold is 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-23T02:22:36Z

Comment Memory

reviewed_at: 2026-08-23T00:00:00Z
review_event: COMMENT
top_themes:
  - no actionable issues in changed lines
  - missing regression test for new dynamic example text
files_reviewed:
  - pkg/workflow/imported_steps_validation.go
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 9.01 AIC · ⌖ 6.8 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /tdd — one observation on test coverage; no blocking issues.

📋 Key Themes & Highlights

Key Themes

Test coverage gap: the new YAML snippet embedded in the error/warning message has no test asserting its presence or format. A future refactor of the fmt.Sprintf assembly could silently drop the user-facing example without failing any test.

Positive Highlights

✅ Using actionpins.GetLatestActionPinByRepo is the right call — the version stays in sync with pinned data automatically and degrades gracefully to "v4".
✅ The comment # example (keep your existing "uses:" ref): correctly sets user expectations and avoids implying they should change their pinned SHA.
✅ Change is minimal and surgical — one logical addition to one function.

@copilot please address the review comment above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 32.3 AIC · ⌖ 12.7 AIC · ⊞ 7.6K
_{Comment /matt to run again}

github-actions · 2026-08-23T02:23:16Z

 			"Without this setting the git token is stored in .git/config and leaked to the agent. "+
-			"Add 'persist-credentials: false' to the 'with:' block of each checkout step. "+
+			"Add 'persist-credentials: false' to the 'with:' block of each checkout step, for example:\n"+
+			persistCredentialsExample+"\n"+


{
"pull_request_number": 54957,
"path": "pkg/workflow/imported_steps_validation.go",
"line": 110,
"body": "[/tdd] The new YAML example snippet has no test asserting its presence or format. A future refactor of the fmt.Sprintf assembly could silently drop the user-facing example without any test failure.\n\n
\n
💡 Suggested test assertions
\n\nAdd to the existing validateCheckoutPersistCredentials tests or a new small test:\n\ngo\nassert.Contains(t, err.Error(), \"- uses: actions/checkout@\")\nassert.Contains(t, err.Error(), \"persist-credentials: false\")\nassert.Contains(t, err.Error(), \"# example\")\n\n\nThese string-contains checks are version-agnostic and add virtually no maintenance cost.\n\n
\n\n@copilot please address this."
}

github-actions

Impeccable review — clarify mode

The change makes the persist-credentials: false compile error actionable by embedding a concrete YAML snippet directly in the message. Using actionpins.GetLatestActionPinByRepo to surface the pinned version is a nice touch, and the fallback to v4 is safe. The comment signals the snippet is illustrative, not copy-paste verbatim.

No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 22.3 AIC · ⌖ 8.97 AIC · ⊞ 6.2K

Copilot

Pull request overview

Adds an actionable YAML example to the checkout credential validation message.

Changes:

Generates the example using the latest embedded checkout version, with a v4 fallback.
Includes the snippet in strict errors and non-strict warnings.

Show a summary per file

File	Description
`pkg/workflow/imported_steps_validation.go`	Adds the inline remediation example.

Review details

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Balanced

+	persistCredentialsExample := fmt.Sprintf(`      # example (keep your existing "uses:" ref):
+      - uses: actions/checkout@%s
+        with:
+          persist-credentials: false`, checkoutVersion)


github-actions · 2026-08-25T05:12:48Z

🎉 This pull request is included in a new release.

Release: v0.87.5

Initial plan

d37f68d

Copilot AI assigned Copilot and pelikhan Aug 23, 2026

Copilot AI linked an issue Aug 23, 2026 that may be closed by this pull request

[deep-report] Add inline YAML fix example to persist-credentials compile error #54942

Closed

Copilot started work on behalf of pelikhan August 23, 2026 01:43

View session

Add inline YAML fix example to persist-credentials compile error

f276175

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add inline YAML fix example for persist-credentials compile error~~ Add inline YAML fix example to persist-credentials compile error Aug 23, 2026

Copilot finished work on behalf of pelikhan August 23, 2026 01:50

Copilot AI requested a review from pelikhan August 23, 2026 01:50

pelikhan reviewed Aug 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 23, 2026 01:54

View session

Use current pinned actions/checkout release (v7.0.1) in fix example

73298fe

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 23, 2026 02:00

Copilot AI requested a review from pelikhan August 23, 2026 02:00

pelikhan reviewed Aug 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 23, 2026 02:07

View session

Resolve checkout version via actionpins manager, use version-only ref…

e6e792e

… in example Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 23, 2026 02:13

Copilot AI requested a review from pelikhan August 23, 2026 02:13

pelikhan marked this pull request as ready for review August 23, 2026 02:17

Copilot AI balanced review requested due to automatic review settings August 23, 2026 02:17

Copilot started reviewing on behalf of pelikhan August 23, 2026 02:18

View session

github-actions Bot reviewed Aug 23, 2026

View reviewed changes

github-actions Bot approved these changes Aug 23, 2026

View reviewed changes

Copilot AI reviewed Aug 23, 2026

View reviewed changes

Comment thread pkg/workflow/imported_steps_validation.go

Comment on lines +101 to +104

persistCredentialsExample := fmt.Sprintf(` # example (keep your existing "uses:" ref):

- uses: actions/checkout@%s

with:

persist-credentials: false`, checkoutVersion)

This was referenced Aug 23, 2026

[aw] No-Op Runs #48838

Closed

[pr-sous-chef] PR Sous Chef run report #54935

Closed

pelikhan merged commit 472ed3a into main Aug 23, 2026
93 of 104 checks passed

pelikhan deleted the copilot/deep-report-add-inline-yaml-fix-example branch August 23, 2026 04:05

Conversation

Copilot AI commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

github-actions Bot Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading