Conversation
- Add hasWorkflowCallTrigger() helper to compiler_workflow_call.go - Add GenerateGitHubFolderCheckoutStep() to checkout_manager.go (uses checkout manager as recommended by @pelikhan) - Modify generateCheckoutGitHubFolderForActivation() to emit cross-repo- aware checkout with github.action_repository expression when workflow_call is detected - Add cross-repo guidance step in buildActivationJob() for actionable error messages when secret validation fails in workflow_call context - Add TestHasWorkflowCallTrigger tests and new compiler_activation_job_test.go - Update wasm golden files for new persist-credentials field ordering - Update glossary.md Trigger File entry with cross-repo information - Add Cross-Repository Trigger File section to central-repo-ops.mdx - Fix incorrect warning about secrets: inherit not working cross-repo Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add cross-repo workflow_call validation and documentation
feat: fix runtime-import in cross-repo workflow_call by detecting callee repository at checkout
Mar 10, 2026
Contributor
|
@copilot disable if inlined-imports is enabled. |
When inlined-imports: true, markdown is embedded at compile time and no runtime-import macros are used. The callee's .md files are not needed at runtime, so the workflow_call cross-repo checkout (github.action_repository) is not needed. Fall back to the standard checkout in that case. Also adds a test case for workflow_call + inlined-imports. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 3372558. When Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot review modified code and reuse checkout manager to generate checkout code |
…anager Converts the standalone package-level function to a method on *CheckoutManager, so the activation job uses the checkout manager abstraction to generate the .github/.agents sparse checkout step. The caller creates NewCheckoutManager(nil) to invoke the method. Test updated to use NewCheckoutManager(nil).GenerateGitHubFolderCheckoutStep(). Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 49acac2. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot add a agentic workflow that uses smoke-workflow-call agentic workflow. Runs on label "water" |
… label water - Add smoke-water.md workflow that triggers on PR label "water" and delegates to smoke-workflow-call.lock.yml via a jobs: uses: entry - Add SecretsInherit field to Job struct to support secrets: inherit for reusable workflow call jobs - Update compiler_jobs.go to parse secrets: inherit string value - Update JSON schema to allow secrets: inherit or map for jobs - Add TestBuildJobsWithReusableWorkflowSecretsInherit test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 539dc0c. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot convert smoke-water agentic workflow into a simple action .yml file that does the trigger |
Replace smoke-water.md + smoke-water.lock.yml with a simple smoke-water.yml that directly calls smoke-workflow-call.lock.yml on PR label "water" or workflow_dispatch, matching the pattern used by smoke-trigger.yml. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in c54da2e. Replaced Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
🧪 Smoke Project is now testing project operations... |
Contributor
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
Contributor
|
📰 BREAKING: Smoke Copilot ARM64 is now investigating this pull request. Sources say the story is developing... |
Contributor
|
🧪 Smoke Temporary ID is now testing temporary ID functionality... |
Contributor
✅ Checkout Validation: PASS
All git commands executed successfully. The PR branch is correctly checked out in the
|
Contributor
|
✅ Smoke Temporary ID completed successfully. Temporary ID validation passed. |
Contributor
|
✅ Smoke Project completed successfully. All project operations validated. |
Contributor
Smoke Test Results
Overall Status: FAIL
|
Contributor
|
🦾 ARM64 Smoke Test — Run §22899200728 Architecture:
Overall:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
ARM64 smoke test agent reviewed PR #20301. The cross-repo workflow_call checkout fix looks solid — centralizing .github/.agents checkout into GenerateGitHubFolderCheckoutStep is a clean refactor, and the conditional github.action_repository expression correctly handles mixed triggers. The secrets: inherit support is well-implemented. One minor nit on strings.Contains for trigger detection (see inline). Overall good work! ✅
📰 BREAKING: Report filed by Smoke Copilot ARM64
| // hasWorkflowCallTrigger checks if the on section contains a workflow_call trigger. | ||
| // Used to detect cross-repo reusable workflow usage for checkout and error handling. | ||
| func hasWorkflowCallTrigger(onSection string) bool { | ||
| return strings.Contains(onSection, "workflow_call") |
Contributor
There was a problem hiding this comment.
strings.Contains works fine for the current on: YAML formats, but worth noting this could theoretically false-positive on a custom event key that contains the substring workflow_call (e.g. workflow_call_custom). A more precise approach using word-boundary regex or YAML parsing would be more robust, though it may be overkill given the current serialized YAML format used internally.
| // - getActionPin: resolves an action reference to a pinned SHA form. | ||
| // | ||
| // Returns a slice of YAML lines (each ending with \n). | ||
| func (cm *CheckoutManager) GenerateGitHubFolderCheckoutStep(repository string, getActionPin func(string) string) []string { |
Contributor
There was a problem hiding this comment.
Nice refactor! Centralizing the .github/.agents checkout logic into GenerateGitHubFolderCheckoutStep eliminates the duplicate inline YAML construction. The repository parameter design is clean — empty string = current repo, expression = cross-repo. The ordering of persist-credentials: false before sparse-checkout also fixes the inconsistency present in the old lock files.
Contributor
|
📰 VERDICT: Smoke Copilot ARM64 has concluded. All systems operational. This is a developing story. 🎤 |
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes cross-repository workflow_call runtime-import failures by making the activation job check out the callee repository (when needed) and adds first-class support for secrets: inherit on reusable-workflow call jobs.
Changes:
- Add
workflow_calltrigger detection and use it to inject a cross-repo-aware.github/.agentssparse checkout (skipped wheninlined-importsis enabled). - Add
secrets: inheritsupport for reusable workflow call jobs across parsing, rendering, tests, and schema validation. - Update documentation and regenerate workflow lock/golden outputs to reflect the new checkout step rendering and cross-repo guidance.
Reviewed changes
Copilot reviewed 180 out of 180 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_workflow_call.go | Adds hasWorkflowCallTrigger helper used for workflow_call detection. |
| pkg/workflow/compiler_workflow_call_test.go | Adds unit tests for hasWorkflowCallTrigger. |
| pkg/workflow/checkout_manager.go | Centralizes .github/.agents sparse-checkout step generation with optional repository:. |
| pkg/workflow/compiler_activation_job.go | Adds cross-repo guidance step; uses centralized checkout generator; injects conditional repository: for workflow_call when not inlining imports. |
| pkg/workflow/compiler_activation_job_test.go | Adds tests verifying conditional repository: behavior and centralized checkout output. |
| pkg/workflow/jobs.go | Adds SecretsInherit to Job and renders secrets: inherit for reusable workflow calls. |
| pkg/workflow/compiler_jobs.go | Parses secrets: inherit for reusable workflow call jobs. |
| pkg/workflow/compiler_jobs_test.go | Adds test ensuring compiled YAML emits secrets: inherit for reusable workflow call jobs. |
| pkg/parser/schemas/main_workflow_schema.json | Extends schema to allow secrets to be either "inherit" or an object map. |
| docs/src/content/docs/reference/glossary.md | Expands “Trigger File” entry to cover cross-repo usage and secrets: inherit implications. |
| docs/src/content/docs/patterns/central-repo-ops.mdx | Adds “Cross-Repository Trigger File” section and corrects secrets: inherit guidance. |
| .github/workflows/smoke-water.yml | Adds new trigger workflow calling the reusable workflow with secrets: inherit. |
| .github/workflows/smoke-workflow-call.lock.yml | Updates activation job to include cross-repo guidance and conditional repository: checkout; reorders checkout with: keys. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden | Updates golden output for checkout with: key ordering. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Updates golden output for checkout with: key ordering. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates golden output for checkout with: key ordering. |
| .github/workflows/workflow-skill-extractor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/workflow-normalizer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/workflow-health-manager.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/workflow-generator.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/weekly-safe-outputs-spec-review.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/weekly-issue-summary.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/weekly-editors-health-check.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/video-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/unbloat-docs.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/ubuntu-image-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/typist.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/tidy.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/test-workflow.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/test-project-url-default.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/test-dispatcher.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/test-create-pr-error-handling.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/terminal-stylist.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/technical-doc-writer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/super-linter.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/sub-issue-closer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/step-name-alignment.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/static-analysis-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/stale-repo-identifier.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-update-cross-repo-pr.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-test-tools.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-temporary-id.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-project.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-multi-pr.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-gemini.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-create-cross-repo-pr.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-copilot.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-copilot-arm.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-codex.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-claude.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/smoke-agent.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/slide-deck-maintainer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/sergo.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/semantic-function-refactor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/security-review.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/security-compliance.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/security-alert-burndown.campaign.g.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/scout.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/schema-consistency-checker.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/safe-output-health.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/research.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/repository-quality-improver.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/repo-tree-map.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/repo-audit-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/release.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/refiner.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/q.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/python-data-charts.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/prompt-clustering-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/pr-triage-agent.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/pr-nitpick-reviewer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/portfolio-analyst.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/poem-bot.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/plan.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/pdf-summary.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/org-health-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/notion-issue-summary.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/metrics-collector.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/mergefest.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/mcp-inspector.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/lockfile-stats.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/layout-spec-maintainer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/jsweep.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/issue-triage-agent.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/issue-monster.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/issue-arborist.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/instructions-janitor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/hourly-ci-cleaner.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/grumpy-reviewer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/gpclean.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/go-pattern-detector.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/go-logger.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/go-fan.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/glossary-maintainer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/github-mcp-tools-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/functional-pragmatist.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/firewall.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/firewall-escape.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/example-workflow-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/example-permissions-warning.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/duplicate-code-detector.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/draft-pr-cleanup.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/docs-noob-tester.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/discussion-task-miner.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dictation-prompt.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/developer-docs-consolidator.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dev.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dev-hawk.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dependabot-go-checker.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dependabot-burner.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/delight.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/deep-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/dead-code-remover.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-workflow-updater.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-testify-uber-super-expert.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-team-status.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-syntax-error-quality.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-semgrep-scan.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-security-red-team.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-secrets-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-safe-outputs-conformance.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-safe-output-optimizer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-repo-chronicle.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-rendering-scripts-verifier.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-regulatory.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-performance-summary.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-observability-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-news.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-multi-device-docs-tester.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-mcp-concurrency-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-malicious-code-scan.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-issues-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-firewall-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-file-diet.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-doc-updater.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-doc-healer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-copilot-token-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-compiler-quality.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-code-metrics.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-cli-tools-tester.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-cli-performance.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-choice-test.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-assign-issue-to-user.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/daily-architecture-diagram.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/craft.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-session-insights.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-pr-prompt-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-pr-nlp-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-pr-merged-report.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-cli-deep-research.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/copilot-agent-analysis.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/contribution-check.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/constraint-solving-potd.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/code-simplifier.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/code-scanning-fixer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/cloclo.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/cli-version-checker.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/cli-consistency-checker.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/claude-code-user-docs-review.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/ci-doctor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/ci-coach.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/chroma-issue-indexer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/changeset.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/breaking-change-checker.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/brave.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/bot-detection.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/blog-auditor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/auto-triage-issues.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/audit-workflows.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/artifacts-summary.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/archie.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/ai-moderator.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/agent-persona-explorer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/agent-performance-analyzer.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
| .github/workflows/ace-editor.lock.yml | Regenerated lock output reflecting checkout with: key ordering. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
+664
to
+669
| switch sv := secrets.(type) { | ||
| case string: | ||
| if sv == "inherit" { | ||
| job.SecretsInherit = true | ||
| } | ||
| case map[string]any: |
There was a problem hiding this comment.
secrets parsing silently ignores string values other than the supported literal inherit. Given the schema now only allows the string constant inherit (or a map), this should return a compilation/validation error for any other string (or unsupported type) to avoid producing a reusable-workflow job that unintentionally runs without the intended secrets configuration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In
workflow_callcontext,github.repositoryis the caller's repo. The activation job'sactions/checkoutwas using that default, so the callee's.mdfiles were never on disk andprocessRuntimeImport()threwERR_SYSTEM: Runtime import file not found.Compiler changes
hasWorkflowCallTrigger(onSection string) bool(compiler_workflow_call.go) — standalone helper, mirrors the detection pattern already used ininjectWorkflowCallOutputs(*CheckoutManager).GenerateGitHubFolderCheckoutStep(repository string, getActionPin func) []string(checkout_manager.go) — method onCheckoutManagerthat centralizes.github/.agentssparse checkout generation; accepts an optionalrepositoryvalue that can be a literal slug or a GitHub Actions expressiongenerateCheckoutGitHubFolderForActivation(compiler_activation_job.go) — creates aNewCheckoutManager(nil)and calls the method; whenworkflow_callis inon:andinlined-importsis not enabled, injects a conditionalrepository:expression:Falls back to the caller's repo for every other event type, so mixed triggers (e.g.
workflow_call+workflow_dispatch) work correctly without a second checkout. Wheninlined-imports: trueis set, the cross-repo conditional is skipped because markdown content is embedded at compile time and no runtime-import macros are used — the callee's.mdfiles are not needed at runtime.Cross-repo guidance step (
buildActivationJob) — injected only whenworkflow_callis present; runs onfailure() && github.event_name == 'workflow_call'and emits::error::annotations directing the caller team to configureCOPILOT_GITHUB_TOKENin their repo.secrets: inheritsupport for reusable workflow call jobs (jobs.go,compiler_jobs.go, JSON schema) — addedSecretsInherit boolto theJobstruct, updated rendering to emitsecrets: inherit, updated the compiler to parse the"inherit"string value (previously only a map was handled), and extended the JSON schema to accept both.New workflow
smoke-water.yml— plain GitHub Actions trigger file (matching the pattern ofsmoke-trigger.yml) that triggers on PR labelwater(plusworkflow_dispatch) and callssmoke-workflow-call.lock.ymlwithsecrets: inheritand the required permissions.Tests
TestHasWorkflowCallTrigger— 6 cases covering mixed triggers, empty string, andworkflow_dispatch-onlyTestGenerateCheckoutGitHubFolderForActivation_WorkflowCall— verifies conditionalrepository:is present/absent based on trigger;action-tagskip behavior preserved;inlined-importscase falls back to standard checkoutTestGenerateGitHubFolderCheckoutStep— covers empty, literal, and expression repository valuesTestBuildJobsWithReusableWorkflowSecretsInherit— verifiessecrets: inheritis correctly emitted in compiled YAML for a reusable workflow call jobDocs
glossary.mdTrigger File entry expanded to mention cross-repo usage andsecrets: inheritbilling implicationscentral-repo-ops.mdx— new## Cross-Repository Trigger Filesection with example caller stub, visibility requirements, secrets config, and how the compiler handles checkout; corrected an existing incorrect warning that statedsecrets: inheritdoes not work across repos (it does)🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.