Skip to content

fix: unique step names for checkout GitHub App token minting steps#24609

Merged
pelikhan merged 5 commits intomainfrom
copilot/fix-duplicate-github-app-token-step
Apr 5, 2026
Merged

fix: unique step names for checkout GitHub App token minting steps#24609
pelikhan merged 5 commits intomainfrom
copilot/fix-duplicate-github-app-token-step

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 4, 2026

When multiple checkout: entries all fall back to the top-level github-app:, GenerateCheckoutAppTokenSteps called buildGitHubAppTokenMintStep for each entry but only replaced the step ID — leaving every minting step named "Generate GitHub App token". The duplicate-name validator then rejected the workflow:

compiler bug: duplicate step 'Generate GitHub App token' found in job 'activation' (positions 14 and 28)

Changes

  • checkout_step_generator.goGenerateCheckoutAppTokenSteps now also replaces the step name with "Generate GitHub App token for checkout (N)", matching the pattern already used by GenerateCheckoutAppTokenInvalidationSteps.

  • duplicate_step_validation_integration_test.go — adds TestDuplicateStepValidation_CheckoutPlusGitHubApp_Integration: compiles a workflow with two cross-repo checkouts + top-level github-app: + tools.github: mode: remote, asserting it compiles without error and produces uniquely-named minting steps.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 8798185/b091/_pkgit in/yaml/v3@v3.0.rev-parse ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE bin/node git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE in/sh git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/docker git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build3674232205/b396/importcfg -pack /tmp/go-build3674232205/b396/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.email test@example.com /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --git-dir go /usr/bin/git th .prettierignogit GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/local/bin/bash -json GO111MODULE 1/x64/bin/npm bash (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha bility_SameInputSameOutput2855190288/001/stability-test.md -pack /usr/bin/git log.showsignaturgit log 64/bin/go git -C /tmp/compile-instructions-test-46603908/.github/workflows rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha ErrorFormatting3638213133/001 --format=%(objectname) 64/bin/bash --write ../../../**/*.jsrev-parse 64/bin/go git -C /tmp/TestGuardPolicyBlockedUsersCommaSeparatedCompiledOutput2763393216/001 remote /usr/bin/git -json GO111MODULE 64/bin/go /usr/bin/git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha ortcfg GFI5vTWRl ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xrepos/{owner}/{repo}/actions/runs/12345/artifacts env 0288/001/stabili.artifacts[].name DefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen2617877993/001' .cfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --paginate repos/{owner}/{repo}/actions/runs/4/artifacts /usr/bin/git .artifacts[].namgit @v1.1.3/cpu/arm6rev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a yVIFwLdjv x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 4232205/b425/_pkgit k/gh-aw/gh-aw/pkrev-parse 4232205/b425=> git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x1 /usr/bin/git runs/20260404-23git 8798185/b248/embrev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -m Initial commit /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha test.txt x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -aw-actions/git/ref/tags/v1.2.3 ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git agent-persona-exgit GO111MODULE e/git git rev-�� --show-toplevel e/git /usr/bin/git 3 pkg/mod/github.crev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -goversion go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build4258798185/b207/importcfg -pack -o /tmp/go-build428-p -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ha8_stub.s env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha master resolved$ /usr/bin/git -c=4 -nolocalimports -importcfg git conf�� user.name Test User /usr/bin/git -json GO111MODULE x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 10/001 GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-current x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha user.email resolved$ /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git on' --ignore-patgit GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha /tmp/go-build4258798185/b236/_pkg_.a -trimpath /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -p golang.org/x/texrev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -ato�� -bool l 1/x64/bin/node -errorsas -ifaceassert -nilfunc 1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha runs/20260404-232948-46146/test-4124468346 sh ache/node/24.14.1/x64/bin/node "prettier" --wrigit git 64/bin/go git t-61�� k/gh-aw/gh-aw/.github/workflows/ai-moderator.md npx /usr/bin/git --write ../../../**/*.jsrev-parse 64/bin/go git (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/docker git rev-�� --show-toplevel docker /usr/bin/git rhysd/actionlint/usr/bin/git go /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /opt/hostedtoolcache/node/24.14.--show-toplevel git rev-�� --show-toplevel node /usr/bin/git /home/REDACTED/worgit go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility : /opt/hostedtoolcache/node/24.14.1/x64/bin/node r: $owner, name: $name) { hasDiscussionsEnabled } } No expressions hgit go /usr/bin/git git rev-�� --show-toplevel git r: $owner, name: $name) { hasDiscussionsEnabled } } --show-toplevel x_amd64/link /snap/bin/bash git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha user.email test@example.com /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha GOMODCACHE resolved$ /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git on' --ignore-patgit GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha echo "��� Built gh-aw.wasm ($(du -h gh-aw.wasm | cut -f1))" -D /usr/lib/git-core/git -gensymabis -o /tmp/go-build425--show-toplevel /usr/lib/git-core/git --gi�� for-each-ref --format=%(objectname) 4232205/b423/vet.cfg prettier --check 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha runs/20260404-232948-46146/test-475689918/.github/workflows node /usr/lib/git-core/git tierignore **/*.cjs 64/bin/go /usr/lib/git-core/git --gi�� for-each-ref --format=%(objectname) /usr/bin/git "prettier" --wrigit git 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha ithub/workflows/agent-persona-explorer.md -importcfg /usr/lib/git-core/git -buildmode=exe -buildid=Dq9vnf8rev-parse -w /usr/lib/git-core/git unpa�� --pack_header=2,3 -q 1/x64/bin/node prettier --check 64/bin/go 1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha "prettier" --check 'scripts/**/*.js' --ignore-path .prettierignore node /usr/lib/git-core/git tierignore **/*.cjs 64/bin/go /usr/lib/git-core/git unpa�� --pack_header=2,3 l /usr/bin/git prettier --write 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name /cpu/byteorder.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env ithub/workflows V3gqgd2UJ x_amd64/link GOINSECURE o8601 GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env 1286130869 ortcfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE pproxy GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-importcfg (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/bin/node GOINSECURE GOMOD GOMODCACHE go 1/x6�� y_with_repos_array_c4145919546/0remote.origin.url GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name mLsRemoteWithRealGitbranch_with_hyphen2617877993/001' 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a KmEF_rn9z ntdrain.test GOINSECURE nal/poly1305 GOMODCACHE ntdrain.test (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 LsRemoteWithRealGitbranch_with_hyphen2617877993/001' 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE /norm 64/src/syscall/js/js_js.s 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.json' --ignore-path ../../../.pr.prettierignore GO111MODULE 86_64/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a UHEwN-QbQ 64/pkg/tool/linux_amd64/vet GOINSECURE a20 GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a z-hV-eFae x_amd64/compile GOINSECURE ack GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 1/x64/bin/npx GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name oding@v0.5.4/iso8601/parse.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env g_.a GO111MODULE stants.test GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 rotocol/go-sdk@v1.4.1/internal/json/json.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env 1286130869 LamLkoYmy 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name mLsRemoteWithRealGitcustom_branch1317669184/001' 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go 1/x6�� y_with_repos_array_c4145919546/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name @v1.1.3/cpu/arm/arm.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a rrG8ct2Bi x_amd64/vet GOINSECURE 64 GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 ohNRO1y8b 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a KjIdi_zAe ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE go-sdk/internal/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE tions/setup/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env ithout_min-integrity3550870561/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name @v1.1.3/cpu/arm64/arm64.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a yVIFwLdjv x_amd64/compile GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile env 1286130869 go x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE tions/setup/js/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts' '**/*.json' --ignore-patremote.origin.url GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name @v1.1.3/cpu/x86/x86.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env til.go o 64/pkg/tool/linux_amd64/compile GOINSECURE go-sdk/internal/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 0/language/coverage.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User env 1286130869 dq87ptaK6 64/pkg/tool/linux_amd64/vet GOINSECURE go-sdk/internal/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE tions/setup/js/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c4145919546/001 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path /tmp/go-build428-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 obyte/asn1 GOMODCACHE 64/pkg/tool/linux_amd64/compile env mpiledOutput104854822/001 i0dFibft1 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git mpiledOutput3232git GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json RG6vPflge ache/go/1.25.8/xgit-upload-pack 'origin' git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel go /usr/bin/git ut1176556867/001git GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE k git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha mpiledOutput104854822/001 YGaDW_VvF 64/pkg/tool/linux_amd64/vet GOINSECURE obyte GOMODCACHE 64/pkg/tool/linux_amd64/vet env ortcfg 57OuoO-7M ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha y_only_defaults_repo587720022/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go 8d51�� 1593993128/.github/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env Gitmain_branch4094623684/001' Gitmain_branch4094623684/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha re GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha --show-toplevel node $name) { hasDiscussionsEnabled } } /home/REDACTED/worgit go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git image:v1.0.0 go /usr/bin/git git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha g_.a LvhFNvMoO 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 82/001/test-simple-frontmatter.md 1T9iaPhBz ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha y_only_defaults_repo587720022/001 GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go 8d51�� 9/001/inlined-b.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a tVIFB3NxN ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go tion�� b/workflows GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE y.s (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -importcfg /tmp/go-build3674232205/b413/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/gitutil/gitutil_test.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3674232205/b396/cli.test /tmp/go-build3674232205/b396/cli.test -test.testlogfile=/tmp/go-build3674232205/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -importcfg /tmp/go-build4258798185/b220/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/sys@v0.42.0/cpu/byteorder.go -o /tmp/go-build428-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)
    • Triggering command: /tmp/go-build2181559243/b396/cli.test /tmp/go-build2181559243/b396/cli.test -test.testlogfile=/tmp/go-build2181559243/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel git (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build428-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE tomic_wasm.s (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --write ../../../**/*.jsGOMOD 64/bin/go --ignore-path ../../../.pretti-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI and others added 3 commits April 4, 2026 23:21
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/96ee3670-b890-4866-8874-41dfc5bf92ec

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
When multiple checkout entries fall back to the top-level github-app,
GenerateCheckoutAppTokenSteps previously used the same step name
'Generate GitHub App token' for all minting steps. The duplicate-name
validator then rejected the workflow with a compiler error.

Fix: add the checkout index to each minting step name so every step
has a unique name ('Generate GitHub App token for checkout (N)').
This mirrors the pattern already used for invalidation steps.

Also add integration test to ensure this combination compiles cleanly.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/96ee3670-b890-4866-8874-41dfc5bf92ec

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix duplicate 'Generate GitHub App token' step in activation job fix: unique step names for checkout GitHub App token minting steps Apr 4, 2026
Copilot AI requested a review from pelikhan April 4, 2026 23:39
@pelikhan pelikhan marked this pull request as ready for review April 4, 2026 23:44
Copilot AI review requested due to automatic review settings April 4, 2026 23:44
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes duplicate-step-name validation failures by ensuring GitHub App token minting steps generated for multiple checkout: entries get unique step names (not just unique IDs), and adds an integration regression test covering the problematic configuration.

Changes:

  • Make checkout GitHub App token minting step names unique via indexed naming (...for checkout (N)).
  • Add an integration test that compiles a workflow with multiple cross-repo checkouts + top-level github-app: + tools.github: mode: remote, asserting unique mint step names.
  • Update an existing generated workflow lockfile.
Show a summary per file
File Description
pkg/workflow/checkout_step_generator.go Renames per-checkout GitHub App token mint step names to be unique and avoid duplicate-name validation errors.
pkg/workflow/duplicate_step_validation_integration_test.go Adds an integration regression test to prevent reintroducing duplicate token mint step names for multi-checkout workflows.
.github/workflows/copilot-token-optimizer.lock.yml Regenerates/updates a compiled lockfile (includes safe-outputs config + heredoc ID churn).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 2

Comment on lines +147 to +156
// Compile workflow — must succeed without a duplicate step error
compiler := NewCompiler()
err = compiler.CompileWorkflow(mdFile)
if err != nil {
if strings.Contains(err.Error(), "duplicate step") {
t.Fatalf("Regression: duplicate step error when combining multiple checkouts + top-level github-app: %v", err)
}
// Other errors are acceptable for this regression test
t.Logf("Compilation failed with non-duplicate-step error (acceptable): %v", err)
return
Copy link

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test currently logs and returns on any non-"duplicate step" compile error. That means the test can pass without asserting anything about the generated workflow/lock file, potentially masking real regressions (including reintroducing duplicate names if the compiler starts erroring earlier for some unrelated reason). Consider making this test fail on compile errors, or explicitly t.Skip only for known/expected environmental failures so the step-name assertions always run when the compiler is functioning.

Suggested change
// Compile workflow — must succeed without a duplicate step error
compiler := NewCompiler()
err = compiler.CompileWorkflow(mdFile)
if err != nil {
if strings.Contains(err.Error(), "duplicate step") {
t.Fatalf("Regression: duplicate step error when combining multiple checkouts + top-level github-app: %v", err)
}
// Other errors are acceptable for this regression test
t.Logf("Compilation failed with non-duplicate-step error (acceptable): %v", err)
return
// Compile workflow — must succeed so the generated lock file can be validated.
compiler := NewCompiler()
err = compiler.CompileWorkflow(mdFile)
if err != nil {
if strings.Contains(err.Error(), "duplicate step") {
t.Fatalf("Regression: duplicate step error when combining multiple checkouts + top-level github-app: %v", err)
}
t.Fatalf("Compilation failed unexpectedly before lock-file assertions could run: %v", err)

Copilot uses AI. Check for mistakes.
Comment on lines +432 to +434
cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_a69d7382b73926ca_EOF'
{"create_issue":{"close_older_issues":true,"expires":168,"max":1,"title_prefix":"[copilot-token-optimizer] "},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":100,"max_file_size":102400,"max_patch_size":51200}]}}
GH_AW_SAFE_OUTPUTS_CONFIG_a69d7382b73926ca_EOF
Copy link

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR updates the generated lockfile, including safe-outputs handler config (e.g., adding close_older_issues) and multiple regenerated heredoc IDs. Since the PR’s stated purpose is checkout token step name uniqueness and this workflow doesn’t have any checkout entries, these lockfile changes look unrelated noise. Consider reverting the lockfile changes (or updating the PR description to explicitly call out that the lockfile was intentionally regenerated/fixed).

Copilot uses AI. Check for mistakes.
@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented Apr 4, 2026

@copilot Review comments

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 4, 2026

@copilot Review comments

Addressed both review comments in d17c045:

  • Test now calls t.Fatalf on any compile error so lock-file assertions always run
  • Reverted the unrelated copilot-token-optimizer.lock.yml changes

@pelikhan pelikhan merged commit c69880d into main Apr 5, 2026
@pelikhan pelikhan deleted the copilot/fix-duplicate-github-app-token-step branch April 5, 2026 00:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: duplicate 'Generate GitHub App token' step in activation job when checkout + tools.github used with top-level github-app

3 participants