Skip to content

fix: label trigger shorthand missing label filter condition in compiled workflow#19824

Merged
pelikhan merged 3 commits intomainfrom
copilot/fix-label-trigger-shorthand
Mar 6, 2026
Merged

fix: label trigger shorthand missing label filter condition in compiled workflow#19824
pelikhan merged 3 commits intomainfrom
copilot/fix-label-trigger-shorthand

Conversation

Copy link
Contributor

Copilot AI commented Mar 6, 2026

The shorthand on: pull_request labeled my-label compiled without a github.event.label.name condition in the activation job's if: clause, causing the workflow to fire on any labeled event.

Root cause

expandLabelTriggerShorthand() stored names as []string, but applyLabelFilter() only type-asserts string or []any. In Go, []string does not satisfy []any, so both branches silently fell through and no condition was emitted. YAML-parsed workflows were unaffected because YAML unmarshalling produces []any naturally.

Changes

  • label_trigger_parser.go — convert labelNames []string to []any before storing in triggerConfig["names"]:
    namesAny := make([]any, len(labelNames))
    for i, name := range labelNames {
        namesAny[i] = name
    }
    triggerConfig["names"] = namesAny
  • label_trigger_parser_test.go, label_trigger_parser_fuzz_test.go, schedule_preprocessing_test.go — update names assertions from .([]string) to .([]any)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.0/xrun /opt/hostedtoolc--auto /tmp�� GOMODCACHE ache/go/1.25.0/xrev-parse /usr/bin/git 13 GO111MODULE ache/node/24.14.--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw node /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse 86_64/node git (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel ache/go/1.25.0/xGO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /tmp/TestHashConsistency_WithImports228839278/001/main.md go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet ith-tools.md GO111MODULE tions/node_modul--show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -ato�� -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/link env 783229/b419/stringutil.test GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel go 0/x64/bin/node -json GO111MODULE 64/bin/go 0/x64/bin/node rev-�� --git-dir go /usr/bin/git -json GO111MODULE 64/bin/go /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git s/test.md -buildtags /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/git /home/REDACTED/worgit -tests /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE node /usr/bin/git prettier --check 64/bin/go git rev-�� --show-toplevel go /usr/bin/infocmp -e -f 64/bin/go infocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git thSetup_GorootOrgit GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha gSGT/4PU8IGZ3xsiiK_VzgSGT config /usr/bin/gh remote.origin.urgit GO111MODULE 64/bin/go gh 7832�� /repos/github/gh-aw/git/ref/tags/v3.0.0 783229/b436/_testmain.go ache/node/24.14.0/x64/bin/node e=false GO111MODULE 64/bin/go ache/node/24.14.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel -tests /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile ck '**/*.cjs' '*git GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build376783229/b422/_pkg_.a l (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 2888c116b4dd41c7GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/xGO111MODULE env 5574144/b401/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/pars-o GOMODCACHE ls (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha g/testutil/tempdGOINSECURE GO111MODULE 64/bin/go GOINSECURE erignore GOMODCACHE VNgnGPLEQds7 env 5574144/b414/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/time-o GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/gh-aw-test-runs/20260306-084512-27773/test-1088296273/.github/workflows config ache/node/24.14.0/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile t-21�� k/gh-aw/gh-aw/.github/workflows/artifacts-summary.md -trimpath ache/node/24.14.0/x64/bin/node -p github.com/githurev-parse -lang=go1.25 ache/node/24.14.0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -bool -buildtags ache/node/24.14.0/x64/bin/node -errorsas -ifaceassert -nilfunc ache/node/24.14.0/x64/bin/node 6365�� uts.version -tests /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel resolved$ /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel -extld=gcc /tmp/go-build376783229/b416/sliceutil.test ck '**/*.cjs' '*git GO111MODULE 64/bin/go /tmp/go-build376783229/b416/sliceutil.test -tes�� -test.paniconexit0 -test.v=true /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha xterm-color (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git .github/workflowgit go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile env 783229/b413/_pkg_.a GO111MODULE 783229/b413=> GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha user.email test@example.com /usr/lib/git-core/git --write ../../../**/*.jsrev-parse 64/bin/go /usr/lib/git-core/git main�� run --auto 0138167/b416/testutil.test --detach GO111MODULE 64/bin/go 0138167/b416/testutil.test (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GOPROXY /usr/local/sbin/sh GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*.js' --ignore-path .prettierignore (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go stlo�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env es.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GOPROXY 93491/b407/vet.cfg l GOWORK 64/bin/go sh -c agent-persona-explorer.md git /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel on 64/bin/go /opt/hostedtoolcache/go/1.25.0/xstatus (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 lint:cjs 93491/b404/vet.cfg GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*.js' --ignore-path .prettierignore l /usr/bin/git --show-toplevel on 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GOPROXY /usr/bin/sh GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*.js' --ignore-pa-errorsas l eutil.test tierignore git 64/bin/go eutil.test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GOPROXY ache/node/24.14.0/x64/bin/node GOSUMDB GOWORK 64/bin/go sh t-40�� k/gh-aw/gh-aw/.github/workflows/agent-persona-ex- git clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle tierignore git 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GOPROXY /usr/sbin/sh GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*.js' --ignore-path .prettierigno--detach git 64/pkg/tool/linux_amd64/vet tierignore git 64/bin/go 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 l 93491/b411/vet.cfg GOSUMDB GOWORK 64/bin/go prettier --ch�� scripts/**/*.js l 64/pkg/tool/linux_amd64/link tierignore git 64/bin/go 64/pkg/tool/linux_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path heck '**/*.cjs' GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 1030903492/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 784649535 GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel go /usr/bin/git k/gh-aw/gh-aw/.ggit -parallel=4 /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git user.name Test User /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha "prettier" --wriGOSUMDB git 64/bin/go rror util.test /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha 1085831357/.github/workflows GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 5574144/b385/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE bagabas/go-udiff-atomic GOMODCACHE go env DfIt/H91eAJ5JZRw-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5574144/b385/imp-tests (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha 5574144/b391/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env IrkB/3csi-u7iA-k-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 5574144/b391/impconfig (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha e=false GO111MODULE 64/bin/go GOINSECURE %H %ct %D 1c0e884e26934fcc-bool go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha "prettier" --wriGOSUMDB git 64/bin/go --show-toplevel go /usr/bin/git go env re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha 470/001/stability-test.md GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x-buildmode=exe GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.0/xtest@example.com /usr/bin/git /usr/bin/git make /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git 277706049 remote.origin.urrev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion iles use Prettiegit GOWORK 64/bin/go bash --no�� --noprofile bash /usr/bin/git --noprofile git 64/bin/go git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD ode-gyp-bin/sh go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go --show-toplevel 64/pkg/tool/linu-c 0/x64/bin/node sh -c npx prettier --wGOSUMDB git 64/bin/go --show-toplevel dwFO3cBOLj36ZOwl/home/REDACTED/.npm/_npx/b388654678d519d9/node_modules/.bin/prettier /usr/bin/git go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build376783229/b383/cli.test /tmp/go-build376783229/b383/cli.test -test.testlogfile=/tmp/go-build376783229/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE ortcfg k/gh�� ternal/tools/actGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE (http block)
    • Triggering command: /tmp/go-build38793491/b383/cli.test /tmp/go-build38793491/b383/cli.test -test.testlogfile=/tmp/go-build38793491/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel 64/pkg/tool/linuenv /usr/bin/git sh -c "prettier" --wriGOINSECURE git 64/bin/go tierignore go /usr/bin/git node (http block)
    • Triggering command: /tmp/go-build1940138167/b001/cli.test /tmp/go-build1940138167/b001/cli.test -test.testlogfile=/tmp/go-build1940138167/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.short=true -test.run=^Test GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE tions/setup/js/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name prettier --write 64/bin/go **/*.ts **/*.json --ignore-path sh -c npx prettier --wGOSUMDB 0/x64/bin/npm 64/bin/go --show-toplevel Vqh7QChbBs18WVNt/home/REDACTED/.npm/_npx/b388654678d519d9/node_modules/.bin/prettier /usr/bin/git go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE tions/setup/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 2 commits March 6, 2026 08:42
…horthand

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…ndition

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix label trigger shorthand to produce correct filter condition fix: label trigger shorthand missing label filter condition in compiled workflow Mar 6, 2026
@pelikhan pelikhan marked this pull request as ready for review March 6, 2026 09:52
Copilot AI review requested due to automatic review settings March 6, 2026 09:53
@pelikhan pelikhan merged commit a84fb20 into main Mar 6, 2026
97 of 98 checks passed
@pelikhan pelikhan deleted the copilot/fix-label-trigger-shorthand branch March 6, 2026 09:53
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes compilation of the on: pull_request labeled <label> shorthand so that the activation job includes a label-name filter condition (preventing workflows from triggering on any labeled event).

Changes:

  • Store label trigger names as []any (instead of []string) so applyLabelFilter can correctly type-assert and emit the github.event.label.name condition.
  • Update unit/fuzz/schedule-preprocessing tests to expect names as []any.
  • Regenerate/update several workflow *.lock.yml files to add per-MCP-server "tools" allowlists in embedded MCP config blocks.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
pkg/workflow/label_trigger_parser.go Converts shorthand-expanded label names into []any so label filtering logic is applied during compilation.
pkg/workflow/label_trigger_parser_test.go Adjusts assertions for names to match the new []any representation.
pkg/workflow/label_trigger_parser_fuzz_test.go Updates fuzz assertions to expect names as []any.
pkg/workflow/schedule_preprocessing_test.go Updates schedule preprocessing test to read names as []any.
.github/workflows/smoke-claude.lock.yml Adds "tools" allowlist to an MCP server entry inside embedded MCP config.
.github/workflows/scout.lock.yml Adds "tools" allowlists for multiple MCP server entries inside embedded MCP config.
.github/workflows/go-pattern-detector.lock.yml Adds "tools": ["*"] for an MCP server entry inside embedded MCP config.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Comment on lines +1649 to +1655
namesRaw, _ := triggerMap["names"].([]any)
var names []string
for _, n := range namesRaw {
if s, isStr := n.(string); isStr {
names = append(names, s)
}
}
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this test, the type assertion result for triggerMap["names"] is ignored (namesRaw, _ := ...). If the value is missing or not a []any, namesRaw will be nil and the test may produce a misleading failure (or even pass when wantLabelNames is empty). Please assert the cast succeeded and fail fast when it doesn’t, and also validate that every element in namesRaw is a string (don’t silently skip non-strings).

See below for a potential fix:

					typesRaw, ok := triggerMap["types"]
					if !ok {
						t.Fatalf("expected trigger %q to have 'types' key", tt.wantTriggerKey)
					}
					types, ok := typesRaw.([]any)
					if !ok {
						t.Fatalf("expected trigger %q 'types' to be []any, got %T", tt.wantTriggerKey, typesRaw)
					}
					if len(types) != 1 || types[0] != "labeled" {
						t.Errorf("expected types=[labeled], got %v", types)
					}
					// names must match the expected labels
					namesVal, ok := triggerMap["names"]
					if !ok {
						t.Fatalf("expected trigger %q to have 'names' key", tt.wantTriggerKey)
					}
					namesRaw, ok := namesVal.([]any)
					if !ok {
						t.Fatalf("expected trigger %q 'names' to be []any, got %T", tt.wantTriggerKey, namesVal)
					}
					var names []string
					for _, n := range namesRaw {
						s, isStr := n.(string)
						if !isStr {
							t.Fatalf("expected all trigger %q 'names' elements to be strings, got element of type %T", tt.wantTriggerKey, n)
						}
						names = append(names, s)

Copilot uses AI. Check for mistakes.
Comment on lines +387 to +391
var names []string
for _, n := range namesRaw {
if s, isStr := n.(string); isStr {
names = append(names, s)
}
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The loop building names silently drops non-string entries from namesRaw. Since names is expected to be a string list, this can mask incorrect types (the test could still pass if enough valid strings remain). Consider failing the test if any element is not a string and also assert the final length matches tt.labelNames to make the check strict.

Suggested change
var names []string
for _, n := range namesRaw {
if s, isStr := n.(string); isStr {
names = append(names, s)
}
if len(namesRaw) != len(tt.labelNames) {
t.Fatalf("expandLabelTriggerShorthand() names length = %d, want %d for %s", len(namesRaw), len(tt.labelNames), tt.entityType)
}
names := make([]string, len(namesRaw))
for i, n := range namesRaw {
s, isStr := n.(string)
if !isStr {
t.Fatalf("expandLabelTriggerShorthand() names[%d] is %T, want string for %s", i, n, tt.entityType)
}
names[i] = s

Copilot uses AI. Check for mistakes.
Comment on lines +113 to +118
// Convert []string to []any so applyLabelFilter can type-assert correctly
namesAny := make([]any, len(labelNames))
for i, name := range labelNames {
namesAny[i] = name
}
triggerConfig["names"] = namesAny
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This conversion to []any works around applyLabelFilter only handling string and []any. However, it also makes the internal representation inconsistent with other Go code that might naturally use []string (and the applyLabelFilter comment in filters.go still claims it supports names: []string). Consider instead (or additionally) updating applyLabelFilter to accept []string too and/or update the documentation/comments to reflect the actual supported types, so future producers don’t have to remember to convert.

Copilot uses AI. Check for mistakes.
Comment on lines +2253 to +2256
},
"tools": [
"*"
]
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These lockfile changes add per-server "tools" allowlists in the embedded MCP config. This seems unrelated to the PR’s stated label-trigger fix and adds noise/merge-conflict surface. If this is an intentional regeneration, please call it out in the PR description (or split into a separate PR); otherwise consider reverting these lockfile-only updates.

Copilot uses AI. Check for mistakes.
Comment on lines 808 to 826
"mcpServers": {
"arxiv": {
"type": "stdio",
"container": "mcp/arxiv-mcp-server"
"container": "mcp/arxiv-mcp-server",
"tools": [
"search_arxiv",
"get_paper_details",
"get_paper_pdf"
]
},
"deepwiki": {
"type": "http",
"url": "https://mcp.deepwiki.com/sse"
"url": "https://mcp.deepwiki.com/sse",
"tools": [
"read_wiki_structure",
"read_wiki_contents",
"ask_question"
]
},
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This lockfile hunk introduces "tools" fields for multiple MCP servers. Since the PR description focuses on label-trigger compilation, these workflow lock changes look like an unrelated regeneration. Please confirm they’re required and document why they’re included here (or split them into a separate PR to keep the fix focused).

Copilot uses AI. Check for mistakes.
Comment on lines 653 to 659
"ast-grep": {
"type": "stdio",
"container": "mcp/ast-grep:latest"
"container": "mcp/ast-grep:latest",
"tools": [
"*"
]
},
Copy link

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This lockfile adds a "tools": ["*"] entry for the ast-grep MCP server, which appears unrelated to the label-trigger shorthand fix described in the PR. If this is an intentional lockfile regeneration, please mention it in the PR description or move it to a separate PR to avoid bundling unrelated workflow changes.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants