ci: split CLI MCP Inspect GitHub matrix group, pin upload-artifact action#19825
ci: split CLI MCP Inspect GitHub matrix group, pin upload-artifact action#19825
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…tion Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates CI configuration to improve runtime by parallelizing a slow CLI MCP GitHub inspection test group, and pins an upload-artifact action reference; additionally updates several workflow lockfiles’ MCP server configs.
Changes:
- Split
TestMCPInspectGitHub*into a dedicated matrix entry (“CLI MCP Inspect GitHub”) and narrow “CLI MCP Other”. - Pin
actions/upload-artifactfor the safe-outputs conformance report upload step. - Add
toolsallowlists to severalmcpServersentries in workflow*.lock.ymlfiles.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/ci.yml | Splits the CLI MCP GitHub inspect tests into a separate matrix job and pins actions/upload-artifact. |
| .github/workflows/smoke-claude.lock.yml | Adds a tools allowlist to the tavily MCP server config. |
| .github/workflows/scout.lock.yml | Adds tools allowlists to multiple MCP server configs (arxiv/deepwiki/markitdown/microsoftdocs/tavily). |
| .github/workflows/go-pattern-detector.lock.yml | Adds a tools allowlist to the ast-grep MCP server config. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| - name: "CLI MCP Connectivity" | ||
| packages: "./pkg/cli" | ||
| pattern: "TestMCPInspectPlaywright|TestMCPGateway" | ||
| - name: "CLI MCP Inspect GitHub" | ||
| packages: "./pkg/cli" | ||
| pattern: "TestMCPInspectGitHub" | ||
| - name: "CLI MCP Other" | ||
| packages: "./pkg/cli" | ||
| pattern: "TestMCPAdd|TestMCPInspectGitHub|TestMCPServer|TestMCPConfig" | ||
| pattern: "TestMCPAdd|TestMCPServer|TestMCPConfig" |
There was a problem hiding this comment.
The PR title/description focuses on splitting the CI test matrix and pinning upload-artifact, but this PR also modifies multiple *.lock.yml workflows (e.g., adding "tools" allowlists under mcpServers). Please either update the PR description to cover these additional behavioral changes or split the lockfile updates into a separate PR to keep scope clear.
Two targeted CI improvements: isolate slow
TestMCPInspectGitHub*tests (~105s of sequential GitHub API calls) into their own parallel matrix job, and pin the last unpinnedupload-artifactreference.Changes
TestMCPInspectGitHubfrom "CLI MCP Other", reducing that group from ~112.5s to ~7.5s; both now run in parallel so critical path = max(105s, 7.5s)TestMCPAdd|TestMCPServer|TestMCPConfigonlysafe-outputs-conformanceartifact upload — pinned fromactions/upload-artifact@v4to@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4, consistent with all other 8 usages in the fileWarning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel /opt/hostedtoolc-buildtags ache/node/24.14.0/x64/bin/node erignore node 64/bin/go ache/node/24.14.0/x64/bin/node s-10�� ub.actor }} go /usr/bin/git -json GO111MODULE x_amd64/vet git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha runs/20260306-084700-26832/test-1787908753/.github/workflows /tmp/go-build652022993/b100/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet l GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -uns�� -unreachable=false /tmp/go-build652022993/b254/vet.cfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha _.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env hX-1cJ7vW cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE x_amd64/vet git init�� GOMODCACHE x_amd64/vet /usr/bin/infocmp -json GO111MODULE x_amd64/vet infocmp(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git thSetup_GorootOrgit GO111MODULE ache/go/1.25.0/x--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/gh-aw-test-runs/20260306-084700-26832/test-1787908753/.github/workflows config /usr/bin/git remote.origin.urgit GOPROXY 64/bin/go git rev-�� --show-toplevel FJCwOJE/MnEy-HzL/tmp/go-build652022993/b254/vet.cfg /usr/bin/git --check scripts/**/*.js 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/compile-instructions-test-1084161913/.github/workflows config /usr/bin/git remote.origin.urgit --check 64/bin/go git init�� --ignore-path go /usr/bin/git GOPATH node 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 0wIm/lS8-RBYSNM6GOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 050168/b393/impo-buildtags -c che/go-build/bf/-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-buildtags(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha prettier --check 64/bin/go **/*.ts **/*.json --ignore-path golangci-lint run(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha "prettier" --check '**/*.cjs' '*GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go git for-�� --format %(refname) 64/bin/go --merged 5ff457d253879119-test.testlogfile=/tmp/go-build652022993/b001/testlog.txt 64/bin/go go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha user.email test@example.com /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link prettier --check 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/link -o /tmp/go-build652022993/b422/styles.test -importcfg /usr/bin/git -s -w -buildmode=exe git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha auto-triage-issues.md g/repoutil/repoutil_test.go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE OhGqih4/C5EvyQA3x6PSYtu1bbVC env _.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE eZ/NMSrG-tAdpRr7JVneKBh/xoh5JXXMIi0eyiR22dVM(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env y-test.md cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet stlo�� -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path m9UW/5-hI2_QMBx6-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 050168/b401/impo-buildtags /hom�� 050168/b401/embe-errorsas **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags -o /tmp/go-build201-errorsas -trimpath 64/bin/go -p main -lang=go1.25 go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet env on GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 7KRlb0f/T36gUPQZXFjOiSQ6baL5(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env -json cfg x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE sh 64/bin/go "prettier" --wri/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet on 64/bin/go go env -json GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE sh 64/bin/go tierignore on 64/bin/go go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE sh 64/bin/go tierignore(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE sh 64/bin/go tierignore(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 1752043660/.github/workflows cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE 050168/b402/impo-buildtags /hom�� k/gh-aw/gh-aw/pk-errorsas k/gh-aw/gh-aw/pk-ifaceassert 64/bin/go **/*.json --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE node /hom�� --check **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-bool go(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build652022993/b383/cli.test /tmp/go-build652022993/b383/cli.test -test.testlogfile=/tmp/go-build652022993/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE 050168/b368/impo/tmp/go-build652022993/b145/vet.cfg -c k/gh-aw/gh-aw/scripts/lint_errorGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-buildtags(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name Q-eU/ZpLY0UQ8eaBGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 050168/b414/impo-buildtags /hom�� k/gh-aw/gh-aw/pk-errorsas k/gh-aw/gh-aw/pk-ifaceassert 64/bin/go **/*.json --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags(http block)If you need me to access, download, or install something from one of these locations, you can either:
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.