Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
Agentic Changeset Generator triggered by this pull request. |
There was a problem hiding this comment.
Pull Request Overview
This PR adds comprehensive documentation for the threat detection feature, focusing on custom detection steps and specialized tool integration patterns. The documentation addresses a gap in explaining how to configure and extend threat detection beyond the default AI-based analysis.
Key changes:
- New comprehensive threat detection guide with configuration reference, custom steps patterns, and LlamaGuard integration example
- Enhanced safe-outputs reference with detailed threat-detection field documentation
- Updated security guide with configuration overview and cross-references
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
docs/src/content/docs/guides/threat-detection.md |
New comprehensive guide covering configuration, AI detection, custom steps, LlamaGuard example, best practices, and troubleshooting |
docs/src/content/docs/reference/safe-outputs.md |
Added threat-detection configuration section with field descriptions, artifact paths, and integration examples |
docs/src/content/docs/guides/security.md |
Enhanced threat detection section with configuration overview and guide cross-reference |
pkg/workflow/schemas/github-workflow.json |
JSON formatting improvements (enum arrays reformatted to multi-line) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| await exec.exec('sh', ['/tmp/install.sh']); | ||
|
|
||
| // Start Ollama service | ||
| exec.exec('ollama', ['serve'], { detached: true }); |
There was a problem hiding this comment.
The exec.exec call is missing await, which could cause the subsequent service readiness check to fail. Add await to ensure the service starts before proceeding to the readiness loop.
| exec.exec('ollama', ['serve'], { detached: true }); | |
| await exec.exec('ollama', ['serve'], { detached: true }); |
| const result = JSON.parse(response.stdout); | ||
| const output = result.message?.content || ''; | ||
|
|
||
| // Check if safe |
There was a problem hiding this comment.
The safety check logic includes output.includes('s8') without explanation. Document what 's8' represents in the LlamaGuard response format to help users understand this condition.
| // Check if safe | |
| // Check if safe | |
| // 's8' is a LlamaGuard response code indicating the output is safe according to its schema. |
| with: | ||
| script: | | ||
| // Install and run Ollama with llama-guard3:1b model | ||
| // See .github/workflows/shared/ollama-threat-scan.md for complete example |
There was a problem hiding this comment.
The referenced file path .github/workflows/shared/ollama-threat-scan.md may not exist or be accessible to users. Verify this file exists in the repository or update the reference to point to the threat detection guide instead.
| // See .github/workflows/shared/ollama-threat-scan.md for complete example | |
| // See the Threat Detection Guide for a complete example: https://github.com/gh-aw/guides/threat-detection/ |
Add `auth.type: github-oidc` option to the HTTP MCP servers section in the guide. The compiler has supported this field since the gateway OIDC implementation (gh-aw-mcpg PR #2878) but the how-to guide only showed static `headers`-based authentication. Fixes documentation gap surfaced by #23605. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The threat detection feature lacked documentation on custom steps/jobs configuration and integration patterns for specialized security tools like LlamaGuard.
Changes
New comprehensive guide (
docs/src/content/docs/guides/threat-detection.md)enabled,prompt,engine,stepsfields with all supported formatsEnhanced reference documentation (
docs/src/content/docs/reference/safe-outputs.md)Updated security guide (
docs/src/content/docs/guides/security.md)Example: Custom Detection with LlamaGuard
Custom steps access these artifacts:
/tmp/gh-aw/threat-detection/prompt.txt- Workflow source/tmp/gh-aw/threat-detection/agent_output.json- Safe output items/tmp/gh-aw/threat-detection/aw.patch- Code changesScreenshot
Documentation follows GitHub Docs style with runnable examples, clear structure, and proper cross-references.
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
telemetry.astro.buildnode /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build(dns block)node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro dev(dns block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
Note
Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using Astro Starlight and GitHub Docs voice
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.