Conversation
- Rec 1: Add fetch-agentics pre-step; add raw.githubusercontent.com to network.allowed; remove Step 1.2 web-fetch instructions - Rec 2: Add collect-repo-structure pre-step; replace Phase 2.1-2.2 bash commands with file-read instructions - Rec 3: Remove web-fetch from tools - Rec 4: Condense Phase 1 cache-check and Phase 3.1 opportunity categories - Rec 5: Replace bash wildcard with allowlist [cat, find, ls, grep] - Recompile with gh aw compile and run postprocess script Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/2788de0a-fa42-4845-8bc2-c8be69f5895c Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR optimizes the Pelis Agent Factory Advisor agentic workflow to reduce token usage and agent turns by pre-fetching reference content and shifting deterministic repo-discovery work out of the agent loop, while also tightening the available tool surface.
Changes:
- Pre-fetches Agentics README content into
.agentics-patterns.txtand adds a.repo-structure.txtsnapshot for the agent to read instead of runningls/findrepeatedly. - Removes the
web-fetchtool and restricts thebashtool allowlist in the workflow frontmatter. - Condenses Phase 1/3 prompt instructions to reduce prompt size and focus opportunity categories.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/pelis-agent-factory-advisor.md |
Adds prefetch/structure steps, removes web-fetch, tightens tool allowlist, and updates prompt instructions to use the precomputed files. |
.github/workflows/pelis-agent-factory-advisor.lock.yml |
Recompiled lockfile reflecting new steps, allowed domain list, tool allowlist changes, and updated rendered prompt IDs. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 4
| done | ||
| - name: Fetch Agentics Patterns | ||
| id: fetch-agentics | ||
| run: | |
There was a problem hiding this comment.
Fetch Agentics Patterns uses a curl | head pipeline but does not enable set -o pipefail. If curl -sf fails, the pipeline exit status will likely still be 0 (from head), so the fallback || echo "(not available)" won’t run and you may end up with an empty .agentics-patterns.txt without noticing. Add set -o pipefail for this step (or otherwise check curl's exit code) so failures are handled deterministically.
| run: | | |
| run: | | |
| set -o pipefail |
| Check cache-memory for `pelis_docs_hash`. Hash `.pelis-agent-factory-docs.txt` | ||
| and `.agentics-patterns.txt`. If unchanged, skip to Phase 2 using cached knowledge. | ||
| Otherwise read both files and update the hash in cache-memory. |
There was a problem hiding this comment.
Phase 1 instructs the agent to compute a SHA-256 hash of .pelis-agent-factory-docs.txt and .agentics-patterns.txt, but the workflow’s bash tool allowlist no longer includes sha256sum (or another deterministic hashing command). An LLM can’t reliably compute SHA-256 from file contents, so the cache check will be unusable in practice. Either precompute the hash in a workflow step and have the agent read it, or expand the bash allowlist minimally (e.g., sha256sum) to support this instruction.
| schedule: | ||
| - cron: "26 21 * * *" | ||
| - cron: "29 10 * * *" | ||
| # Friendly format: daily (scattered) |
There was a problem hiding this comment.
The compiled lock workflow’s daily cron time changed from 26 21 * * * to 29 10 * * *. This isn’t mentioned in the PR description and will shift when the advisor runs. If the run time matters, consider pinning an explicit cron in the source .md (instead of schedule: daily) or confirm this shift is intentional/acceptable.
| network: | ||
| allowed: | ||
| - "github.github.io" | ||
| - "raw.githubusercontent.com" |
There was a problem hiding this comment.
raw.githubusercontent.com was added to network.allowed, but after removing web-fetch and restricting bash to not include curl, the agent itself can’t fetch from that domain anyway (and the pre-fetch step runs outside the sandboxed agent container). If the goal is least-privilege network egress for the agent, consider removing raw.githubusercontent.com from network.allowed and keeping the agent fully offline with respect to Agentics content (since it’s already pre-fetched into the workspace).
| - "raw.githubusercontent.com" |
- Add set -o pipefail to Fetch Agentics Patterns step so curl failures propagate through the pipe to head - Precompute SHA-256 content hash in a new workflow step instead of asking the agent to hash files (sha256sum not in allowlist) - Remove raw.githubusercontent.com from network.allowed since the agent can't fetch from it (no curl or web-fetch available) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Smoke Test Results — Claude ✅ PASS
Overall: PASS
|
🔥 Smoke Test Results — PASS
PR: ⚡ pelis-agent-factory-advisor: pre-fetch content, restrict tools, reduce prompt tokens (~21% token savings) Overall: PASS
|
Smoke Test Result
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Notes
|
Smoke Test: GitHub Actions Services Connectivity
All checks failed.
|
The workflow was wasting 1–3 LLM turns on a blocked
web-fetchtogithub.com/githubnext/agenticsand running deterministic shell commands (ls,find) inside the agent loop, accumulating unnecessary context across 11 turns (~$2.02/run).Changes
steps:): newfetch-agenticsstep pullsraw.githubusercontent.com/githubnext/agentics/main/README.mdinto.agentics-patterns.txtbefore the agent starts; addsraw.githubusercontent.comtonetwork.allowedsteps:): newcollect-repo-structurestep runsls/findonce into.repo-structure.txt; Phase 2.1–2.2 now reads the file instead of making the agent run bashweb-fetchtool: no longer needed once both doc sources are pre-fetched; eliminates ~700 tokens/turn of schema overheadbashallowlist:["*"]→["cat", "find", "ls", "grep"]; reduces schema size and narrows command surfaceProjected impact: ~1,399K → ~1,100K tokens/run (−21%), ~$2.02 → ~$1.60/run, 11 → ~8–9 LLM turns.
Recompiled via
gh aw compileand post-processed vianpx tsx scripts/ci/postprocess-smoke-workflows.ts.