Increase Code Scanning Fixer execution budget - #58861
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
Category: bug | Risk: medium | Score: 39 | Action: defer | Batch: workflow-reliability. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
🟡 Changes recommended
The workflow timeout was raised to 40 minutes, but the prompt still uses 30-minute stall-detection/exclusion thresholds that can produce incorrect “stalled” behavior.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the Code Scanning Fixer agentic workflow configuration to reduce premature failures by increasing the workflow execution budget and aligning the workflow’s allowed local shell-reader tools with the prompt’s cache-inspection instructions.
Changes:
- Increase
timeout-minutesfrom 30 → 40 (and propagate the change into the generated.lock.ymlruntime/env values). - Expand the
bashallowlist to includecatandheadfor inspecting temporary cache-memory files. - Update the prompt’s “Self-Assessment Checkpoint” timeout reference to 40 minutes.
Security / correctness notes
- The prompt still uses 30-minute thresholds when deciding whether an
in_progresscache record is stalled (and when to exclude still-in-flight attempts). With a 40-minute timeout, those thresholds can cause false “stalled” reporting and unnecessary skipping.
Validation / scanner results
- Not run in this review environment (static diff review only).
File summaries
| File | Description |
|---|---|
| .github/workflows/code-scanning-fixer.md | Increases timeout budget, permits cat/head for cache inspection, and updates prompt text to match the new timeout. |
| .github/workflows/code-scanning-fixer.lock.yml | Regenerates compiled workflow to reflect the updated timeout and tool allowlist in the runner configuration. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| - Do not use the Copilot `read` tool for temporary files; use allowed shell readers such as `cat`, `head`, or `sed` | ||
| - Create pull request: emit a `create-pull-request` safe output after edits | ||
| - Report a stalled prior attempt: emit a `create-issue` safe output (diagnostic only, never a fix) | ||
|
|
||
| **Self-Assessment Checkpoint**: This workflow has a hard 20-minute timeout. A hang or timeout during the fix-attempt phase (steps 5-6) previously produced zero output and zero visibility. To avoid that: | ||
| **Self-Assessment Checkpoint**: This workflow has a hard 40-minute timeout. A hang or timeout during the fix-attempt phase (steps 5-6) previously produced zero output and zero visibility. To avoid that: |
|
🎉 This pull request is included in a new release. Release: |
The Code Scanning Fixer exceeded its 30-minute execution limit after repeated denied local-reader calls. This updates its runtime budget and aligns permitted tools with its cache-inspection instructions.
Execution budget
timeout-minutesfrom 30 to 40.Tool allowlist
catandhead, which the workflow prompt instructs the agent to use for temporary cache files.