The detection job runs unconditionally after the agent job, wasting CI resources when there's nothing to scan (no safe outputs and no patch).

Changes

JavaScript (collect_ndjson_output.cjs)

• Check for /tmp/gh-aw/aw.patch existence and set has_patch output

Go Compiler (compiler_jobs.go)

• Export has_patch output from agent job alongside existing output and output_types

Detection Job (threat_detection.go)

• Add conditional: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
• Job skips when both no safe outputs generated AND no patch exists

Tests

• Add TestDetectionJobSkipCondition to verify conditional logic
• Update existing tests for new output field

Example

Generated workflow now includes:

agent:
  outputs:
    has_patch: ${{ steps.collect_output.outputs.has_patch }}
    output: ${{ steps.collect_output.outputs.output }}
    output_types: ${{ steps.collect_output.outputs.output_types }}

detection:
  needs: agent
  if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
  runs-on: ubuntu-latest

Detection job now skips when there's nothing to analyze, reducing unnecessary workflow executions.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.