Surface pre-activation denial reason in job summary#24792
Merged
Conversation
This was referenced Apr 6, 2026
…easons in job summary (#bot-gated-pr-review-issue) Agent-Logs-Url: https://github.com/github/gh-aw/sessions/067ab295-8ff2-4434-9c93-bad0eb8fe31b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix disappearing bot-gated PR review runs
Surface pre-activation denial reason in job summary
Apr 6, 2026
This was referenced Apr 6, 2026
…a separate step Agent-Logs-Url: https://github.com/github/gh-aw/sessions/483d2eeb-3b22-4f64-883c-a0c08a888fc0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/483d2eeb-3b22-4f64-883c-a0c08a888fc0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 516fff6. The denial summary is now written inline within each existing check script at the point of denial — no separate step needed. Each check ( Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot use markdown templates in actions/setup/md and renderTemplateFile to create the messages. |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c1738814-b8e8-4593-88d9-cf889cb728c3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
… test Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c1738814-b8e8-4593-88d9-cf889cb728c3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in aebc5d6. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR makes pre-activation denials visible in the GitHub Actions job summary by having pre-activation check scripts write a standardized “activation skipped” summary (rendered from a shared markdown template) at the point they deny activation.
Changes:
- Added a shared markdown template and helper (
writeDenialSummary) to render/write a denial summary to$GITHUB_STEP_SUMMARY. - Updated multiple pre-activation check scripts to call the shared helper when they deny activation (bots/roles/stop-time/query/check-failing/command-position, etc.).
- Added/updated Vitest coverage to exercise the new helper and accommodate summary-writing in relevant script tests.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_pre_activation_job.go | Adds a new comment near pre-activation job compilation logic (currently misleading). |
| actions/setup/md/pre_activation_skip.md | New shared markdown template for “activation skipped” job summary output. |
| actions/setup/js/pre_activation_summary.cjs | New helper to render/write denial summaries (template-first with fallback). |
| actions/setup/js/pre_activation_summary.test.cjs | New tests for template rendering + fallback behavior. |
| actions/setup/js/check_stop_time.cjs | Writes denial summary when stop-time prevents activation. |
| actions/setup/js/check_skip_roles.cjs | Writes denial summary when actor role is in skip-roles. |
| actions/setup/js/check_skip_roles.test.cjs | Mocks/adjusts summary behavior for new denial summary calls. |
| actions/setup/js/check_skip_if_no_match.cjs | Writes denial summary when query returns too few matches. |
| actions/setup/js/check_skip_if_no_match.test.cjs | Adds a core.summary mock to support new summary writes. |
| actions/setup/js/check_skip_if_match.cjs | Writes denial summary when query exceeds match threshold. |
| actions/setup/js/check_skip_if_check_failing.cjs | Writes denial summary when base-branch checks are failing. |
| actions/setup/js/check_skip_if_check_failing.test.cjs | Adds a core.summary mock to support new summary writes. |
| actions/setup/js/check_skip_bots.cjs | Writes denial summary when actor is in skip-bots. |
| actions/setup/js/check_skip_bots.test.cjs | Adds a core.summary mock to support new summary writes. |
| actions/setup/js/check_membership.cjs | Writes denial summary for config/bot/permission/api denial outcomes. |
| actions/setup/js/check_membership.test.cjs | Stubs the new helper module to keep membership tests self-contained. |
| actions/setup/js/check_command_position.cjs | Writes denial summary when trigger comment doesn’t start with required command. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 17/17 changed files
- Comments generated: 2
Comment on lines
+442
to
446
| // generateReportSkipStep generates the "Report skip reason" step for the pre-activation job. | ||
| // The step runs with if: always() and writes skip reasons to the GitHub Actions job summary | ||
| // extractPreActivationCustomFields extracts custom steps and outputs from jobs.pre-activation field in frontmatter. | ||
| // It validates that only steps and outputs fields are present, and errors on any other fields. | ||
| // If both jobs.pre-activation and jobs.pre_activation are defined, imports from both. |
There was a problem hiding this comment.
The added Go doc comment references generateReportSkipStep, but there is no such function in this file (and the comment is placed immediately before extractPreActivationCustomFields). This is misleading in Godoc and can confuse future readers. Either add/restore the referenced function, or move/rename this comment to match the actual function it documents.
Suggested change
| // generateReportSkipStep generates the "Report skip reason" step for the pre-activation job. | |
| // The step runs with if: always() and writes skip reasons to the GitHub Actions job summary | |
| // extractPreActivationCustomFields extracts custom steps and outputs from jobs.pre-activation field in frontmatter. | |
| // It validates that only steps and outputs fields are present, and errors on any other fields. | |
| // If both jobs.pre-activation and jobs.pre_activation are defined, imports from both. | |
| // extractPreActivationCustomFields extracts custom steps and outputs from the | |
| // jobs.pre-activation field in frontmatter. | |
| // It validates that only steps and outputs fields are present, and errors on | |
| // any other fields. | |
| // If both jobs.pre-activation and jobs.pre_activation are defined, it imports | |
| // from both. |
| content = renderTemplateFromFile(templatePath, { reason, remediation }); | ||
| } catch (err) { | ||
| // Log unexpected errors but still fall through to the hardcoded fallback | ||
| if (err && typeof err === "object" && "code" in err && err.code !== "ENOENT") { |
There was a problem hiding this comment.
The catch block intends to log “unexpected errors”, but it only warns when the thrown value has a code property and that code is not ENOENT. If renderTemplateFromFile throws an Error without code, the error is silently swallowed and you fall back without any warning. Consider warning for all errors except ENOENT (including when err.code is missing) so template rendering problems don’t get hidden.
Suggested change
| if (err && typeof err === "object" && "code" in err && err.code !== "ENOENT") { | |
| const isEnoent = !!(err && typeof err === "object" && "code" in err && err.code === "ENOENT"); | |
| if (!isEnoent) { |
This was referenced Apr 6, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
pre_activationdenies activation (bot/role gate), all downstream jobs silently skip — leaving the PR with no check row, no neutral indicator, and no visible reason. The only trace is buried in raw job logs.What changes
Each pre-activation check script now writes a
$GITHUB_STEP_SUMMARYdirectly at the point of denial — no extra compiled step required. When a check denies activation, it emits a summary rendered from a shared markdown template with the specific reason and a targeted remediation hint.Example summary output when a bot is denied:
Markdown template
actions/setup/md/pre_activation_skip.mddefines the summary layout with{reason}and{remediation}placeholders. The file is copied to${RUNNER_TEMP}/gh-aw/prompts/at runtime bysetup.sh(alongside all other prompt templates). A shared helperpre_activation_summary.cjsusesrenderTemplateFromFilefrommessages_core.cjsto load and render it; if the template is unavailable it falls back to a hardcoded equivalent.Check scripts updated
check_membership.cjsinsufficient_permissions,bot_not_active,api_error,config_errorcheck_skip_bots.cjson.skip-botslistcheck_skip_roles.cjson.skip-roleslistcheck_stop_time.cjson.stop-aftertimecheck_skip_if_match.cjson.skip-if-matchquery matchedcheck_skip_if_no_match.cjson.skip-if-no-matchquery returned too few resultscheck_skip_if_check_failing.cjscheck_command_position.cjsEach script calls
writeDenialSummary(reason, remediation)frompre_activation_summary.cjsinstead of inlining markdown.No compiler changes needed
The denial summary is written inline within the existing check step — no additional step is added to compiled workflow YAML and no new compiler logic or constants are required.