Conversation
…tadata to first line - Add CollectActionReferences() to extract external uses: refs from YAML - Move gh-aw-metadata to be the first line of lock files - Add '# Secrets used:' and '# Custom actions used:' sections in header - Generate body first to collect secrets/actions before header is written - Add tests for CollectActionReferences and lock file header ordering - Recompile all 184 workflows with new header format Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7b42071d-e47b-4be4-aa1f-e315084741be Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot merge main and recompile |
There was a problem hiding this comment.
Pull request overview
This PR improves generated GitHub Actions lock file headers by making external dependencies more human- and machine-readable, primarily by moving the gh-aw-metadata JSON block to the first line and adding explicit manifests for referenced secrets and external actions.
Changes:
- Emit
# gh-aw-metadata: {...}as the first line in generated lock files and append new header sections for “Secrets used” and “Custom actions used”. - Add regex-based extraction for external
uses:references (CollectActionReferences) alongside existing secret reference collection. - Refactor YAML generation to build the workflow body first, then derive secrets/actions lists for the header.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_yaml.go | Refactors YAML generation order; updates header generation to place gh-aw-metadata first and to print secrets/actions manifests. |
| pkg/workflow/redact_secrets.go | Adds CollectActionReferences and a uses:-matching regex to extract and dedupe external action references. |
| pkg/workflow/compiler_yaml_helpers_test.go | Updates unit test call site for the expanded generateWorkflowHeader signature. |
| .github/workflows/*.lock.yml | Regenerates lock files to reflect new header structure (metadata first line; secrets/actions manifests). |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
pkg/workflow/redact_secrets.go:80
CollectActionReferencesclaims to return a deduplicated list ofuses:values, but it deduplicates onentry(ref + optional tag comment). If the same action ref appears with different inline tags/comments (or once with and once without), it will be emitted multiple times. Consider deduplicating by ref and choosing a single display string (e.g., prefer the one with a tag comment when available).
- Files reviewed: 189/189 changed files
- Comments generated: 2
| // actionReferencePattern matches "uses: <action-ref>" lines in YAML, including | ||
| // both key-value format ("uses: ref") and list-item format ("- uses: ref"). | ||
| // Captures the action reference (group 1) and optional inline comment tag (group 2). | ||
| var actionReferencePattern = regexp.MustCompile(`(?m)^\s+(?:-\s+)?uses:\s+(\S+)(?:\s+#\s*(.+?))?$`) |
There was a problem hiding this comment.
actionReferencePattern currently requires at least one leading whitespace (^\s+) and does not tolerate trailing whitespace after the ref unless an inline comment is present. This will miss valid uses: lines like uses: actions/checkout@sha or uses: actions/checkout@sha# v4 (no space before #). Consider relaxing the regex to ^\s*(?:-\s+)?uses:\s*(\S+)\s*(?:#\s*(.*))?$ so extraction is resilient to formatting differences.
This issue also appears on line 64 of the same file.
| // Add lock metadata as the very first line for easy machine parsing. | ||
| // Single-line JSON format to minimize merge conflicts. | ||
| if frontmatterHash != "" { | ||
| agentInfo := AgentMetadataInfo{} | ||
| // Agent ID: prefer EngineConfig.ID, fall back to legacy AI field |
There was a problem hiding this comment.
The new requirement is that # gh-aw-metadata: {...} is line 1 of every lock file for machine parsing, but this header only emits metadata when frontmatterHash != "". If hash computation fails (currently treated as non-fatal), the lock file will revert to starting with the ASCII banner and break the parsing contract. Consider always emitting gh-aw-metadata (allowing empty frontmatter_hash) or making hash computation failure fatal for lockfile generation.
…nd-actions-to-lockfile # Conflicts: # .github/workflows/claude-token-optimizer.lock.yml # .github/workflows/claude-token-usage-analyzer.lock.yml # .github/workflows/copilot-token-optimizer.lock.yml # .github/workflows/copilot-token-usage-analyzer.lock.yml # .github/workflows/token-logs-fetch.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in d41c4e8. Merged Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
- Update gh aw audit diff signature to reflect multi-run support: accepts one base run and one or more comparison runs (from #24544) - Document token usage diff breakdown (input/output/cache tokens, API requests, cache efficiency) added in #24544 - Document JSON array output and divider behavior for multiple diffs - Add lock file header section to workflow-structure.md documenting the gh-aw-metadata first-line placement and the Secrets/Custom actions manifest sections added in #24495 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Lock files lacked a human-readable manifest of their external dependencies, and
gh-aw-metadatawas buried after the ASCII banner making machine parsing cumbersome.Changes
Header structure
# gh-aw-metadata: {...}is now line 1 of every lock file (before the ASCII logo)# Secrets used:— sorted, deduplicated list of allsecrets.*references in the workflow# Custom actions used:— sorted, deduplicated list of all externaluses:references (local./refs excluded), including inline version tagsExample output
Implementation
CollectActionReferences(yamlContent string) []stringadded toredact_secrets.go— regex-based extraction of externaluses:values, supporting bothuses: refand- uses: refYAML formsgenerateYAMLnow generates the workflow body first, then passes collected secrets/actions intogenerateWorkflowHeader— avoids a two-pass scangenerateWorkflowHeadersignature extended withsecrets []string, actions []string; metadata block moved to top