feat(logs): add top-level `classification` field to `RunData` in logs response by Copilot · Pull Request #24394 · github/gh-aw

Copilot · 2026-04-03T22:24:55Z

The risk classification (risky/normal/baseline) produced by the detection pipeline was only accessible via runs[].comparison.classification.label, which is null when no baseline exists — making it unusable for consumers that need a guaranteed, flat field.

Changes

RunData.Classification field — new top-level string field always populated with one of four values:
- "risky" — risk signal detected (posture escalation, new MCP failure, blocked-request increase)
- "normal" — no risk signals; run matches baseline ("stable" or "changed" internally)
- "baseline" — no prior successful run to compare against; this run is the baseline
- "unclassified" — comparison data absent or incomplete
deriveRunClassification(*AuditComparisonData) string — helper that encodes the mapping above, set in buildLogsData for every run
Guardrail schema — updated runs field description in getLogsDataSchema() to document classification and its values

Usage

// gh aw logs --json | jq '.runs[] | {id: .database_id, classification}'
{"id": 12345, "classification": "risky"}
{"id": 12346, "classification": "normal"}
{"id": 12347, "classification": "baseline"}

Consumers no longer need to guard against null at multiple nesting levels to extract risk classification.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw Ffi6x77fi ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x12345 /usr/bin/git rtcfg GO111MODULE .cfg git (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name /tmp/go-build121-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-persona-explorer.md x_amd64/compile /usr/bin/git -json GO111MODULE 64/bin/go git init�� GOMODCACHE go /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/go-build2367014876/b417/_pkg_.a -trimpath 1/x64/bin/node -p main -lang=go1.25 1/x64/bin/node -C /tmp/gh-aw-test-runs/20260403-223402-31443/test-3881425306/.github/workflows rev-parse /usr/bin/git go1.25.8 -c=4 -nolocalimports git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 1269170767/custom/workflows xpQFH7LFx 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu12346 env rtcfg cjNZiRS1g ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git itmain_branch384git itmain_branch384rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git 514491309/.githugit GO111MODULE x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git ai-moderator.md GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� .*/\1/p ache/go/1.25.8/x64/pkg/tool/linuREDACTED /usr/bin/gh 2 pkg/mod/github.crev-parse 7014876/b430=> gh (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha ere x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git init�� GOMODCACHE x_amd64/compile /usr/bin/git ub/workflows GO111MODULE x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha .actor }}, Unsafe: ${{ secrets.TOKEN }} x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git ub/workflows o x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ortcfg /usr/bin/git edcfg GO111MODULE ingutil.test git rev-�� --show-toplevel ingutil.test /usr/bin/git archie.md jfLv/0caWgwAWMGdrev-parse 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -goversion go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build880477802/b205/importcfg -pack -o /tmp/go-build121-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/TestHashConsistency_InlinedImports3665387599/001/inlined-b.md epo}/actions/runs/4/artifacts /usr/bin/git e GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git /workflows 1.4.1/internal/jrev-parse x_amd64/compile git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/TestHashConsistency_InlinedImports3665387599/001/inlined-a.md epo}/actions/runs/2/artifacts /usr/bin/git e GO111MODULE x_amd64/compile git conf�� user.email test@example.com /usr/bin/git -json age/compact/comprev-parse x_amd64/compile git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha licyTrustedUsersRequiresMinIntegrity3995874154/001 -trimpath /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link l github.com/githurev-parse -lang=go1.25 7014876/b430/importcfg -V=f�� -aw/git/ref/tags/v3.0.0 k/gh-aw/gh-aw/pkg/semverutil/semverutil_test.go 1/x64/bin/node go1.25.8 -c=4 -nolocalimports 1/x64/bin/node (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha -unreachable=false resolved$ /usr/bin/git -json GO111MODULE x_amd64/compile git init�� GOMODCACHE x_amd64/compile /usr/bin/git b/workflows n/codec.go x_amd64/compile git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /tmp/go-build880477802/b177/_pkg_.a l ache/go/1.25.8/x64/pkg/tool/linux_amd64/link -p mime -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/link -ato�� 7014876/b440/styles.test -buildtags ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha /tmp/go-build880477802/b166/_pkg_.a -trimpath ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p crypto/ed25519 -lang=go1.25 ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -o /tmp/go-build2367014876/b404/_pkg_.a -trimpath (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE D7/90LsJdncQeTVLTest User env 3881425306/.github/workflows rotocol/go-sdk@v1.4.1/internal/util/net.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a 4.0/internal/doc.go 64/pkg/tool/linux_amd64/compile GOINSECURE tants GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a rotocol/go-sdk@v1.4.1/internal/mcpgodebug/mcpgodebug.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 at.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE X2/LKPpO0EjZIaEYTest User env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/home/REDACTED/work/gh-aw/gh-aw/pkg/styles/theme.go env _.a @v1.1.3/cpu/x86/x86.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 299768dba98fa2e9c 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env 1959116123/.github/workflows GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name poll/fd.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env _.a 0/internal/language/compact/compact.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env y_only_defaults_repo916539675/001 glpNKSOQr 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-tests env _.a rotocol/go-sdk@v1.4.1/internal/json/json.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 mLsRemoteWithRealGitmain_branch3841300072/001' 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env y_with_explicit_repo2402320846/0remote.origin.url GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 54418433/.github/workflows rotocol/go-sdk@v1.4.1/internal/jsonrpc2/conn.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env y_with_explicit_repo2402320846/001 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE ic_wasm.o 64/src/internal/--git-dir 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 54418433/.github/workflows 0/language/coverage.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE WKKjjpb/pnOHWmOW0VPsKVyXPZlC env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path /tmp/go-build121-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD wasm.s go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linu.github/workflows/test.md env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel 64/pkg/tool/linuTest User /usr/bin/git _.a @v1.1.3/cpu/arm/rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linuTest User /usr/bin/git _.a GO111MODULE 64/pkg/tool/linugit-upload-pack 'origin' git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env e-analyzer.md GO111MODULE /opt/hostedtoolcache/go/1.25.8/x-nilfunc GOINSECURE GOMOD bis go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD s go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env 3566582678 dAR9m3zY_ /opt/hostedtoolcache/go/1.25.8/x-lang=go1.25 GOINSECURE a20poly1305 GOMODCACHE go (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env edOutput20385888/001 GO111MODULE x_amd64/link GOINSECURE GOMOD bis x_amd64/link (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD ha8_stub.s go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json d.go 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build2367014876/b396/cli.test /tmp/go-build2367014876/b396/cli.test -test.testlogfile=/tmp/go-build2367014876/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build880477802/b203/importcfg -pack -V=f�� x_amd64/vet sh 64/bin/go "prettier" --wri/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile x_amd64/vet 64/bin/go go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build121-p -trimpath 64/bin/go -d github.com/ayman-o -lang=go1.24 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Add a top-level `classification` string field to `RunData` so that consumers of the MCP `logs` tool and `gh aw logs --json` can access the risk classification without traversing the nested `comparison.classification.label` path (which returns null when no baseline is available). Possible values: "risky", "normal", "baseline", "unclassified". - pkg/cli/logs_report.go: new Classification field + deriveRunClassification helper - pkg/cli/mcp_logs_guardrail.go: update schema description - pkg/cli/logs_report_test.go: TestDeriveRunClassification unit tests Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d90a23df-256e-4f7a-b65b-8de6e8ace6cf Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

Adds a guaranteed, flat risk classification string to each workflow run in the logs JSON output so consumers don’t need to rely on nullable nested comparison fields.

Changes:

Introduces a top-level RunData.Classification field in logs output.
Adds deriveRunClassification(*AuditComparisonData) string and wires it into buildLogsData for every run.
Updates the MCP logs guardrail schema description to document classification and its allowed values.

Show a summary per file

File	Description
pkg/cli/mcp_logs_guardrail.go	Documents the new `classification` field and allowed values in the logs schema description.
pkg/cli/logs_report.go	Adds `RunData.Classification` and derives it from audit comparison data during logs data construction.
pkg/cli/logs_report_test.go	Adds unit tests for the classification derivation helper.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 1

Copilot · 2026-04-03T22:46:24Z

pkg/cli/logs_report_test.go

+// TestDeriveRunClassification tests the classification mapping helper.
+func TestDeriveRunClassification(t *testing.T) {
+	tests := []struct {
+		name       string
+		comparison *AuditComparisonData
+		want       string


The new classification field is part of the public logs JSON surface area, but current tests only validate deriveRunClassification in isolation. Consider adding/adjusting a buildLogsData test assertion that RunData.Classification is always populated and matches the expected mapping (e.g., baseline/no-baseline, risky, normal) so the API contract can’t regress if buildLogsData stops setting the field.

Initial plan

93cf31a

Copilot AI assigned Copilot and lpcox Apr 3, 2026

Copilot started work on behalf of lpcox April 3, 2026 22:25 View session

Copilot AI linked an issue Apr 3, 2026 that may be closed by this pull request

feat(mcp): Include classification label in logs tool response #24371

Closed

Copilot AI changed the title ~~[WIP] Add classification label to logs tool response~~ feat(logs): add top-level classification field to RunData in logs response Apr 3, 2026

Copilot AI requested a review from lpcox April 3, 2026 22:39

Copilot finished work on behalf of lpcox April 3, 2026 22:39

pelikhan approved these changes Apr 3, 2026

View reviewed changes

pelikhan marked this pull request as ready for review April 3, 2026 22:42

Copilot AI review requested due to automatic review settings April 3, 2026 22:42

Copilot started reviewing on behalf of pelikhan April 3, 2026 22:42 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

pelikhan merged commit 6a093ec into main Apr 3, 2026
67 checks passed

pelikhan deleted the copilot/feat-include-classification-label branch April 3, 2026 22:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(logs): add top-level `classification` field to `RunData` in logs response#24394

feat(logs): add top-level `classification` field to `RunData` in logs response#24394
pelikhan merged 2 commits intomainfrom
copilot/feat-include-classification-label

Copilot AI commented Apr 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Usage

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 3, 2026 •

edited

Loading