diff --git a/.changeset/patch-harden-detection-cache-access.md b/.changeset/patch-harden-detection-cache-access.md new file mode 100644 index 00000000000..0ba104c1e5f --- /dev/null +++ b/.changeset/patch-harden-detection-cache-access.md @@ -0,0 +1,5 @@ +--- +"gh-aw": patch +--- + +Harden detection-gated cache access by restricting cache publication to trusted runtime events and requiring explicit detection acceptance before persisting agent memory. diff --git a/.github/workflows/ab-testing-advisor.lock.yml b/.github/workflows/ab-testing-advisor.lock.yml index 9ed420c9a0f..cbc44c12930 100644 --- a/.github/workflows/ab-testing-advisor.lock.yml +++ b/.github/workflows/ab-testing-advisor.lock.yml @@ -515,6 +515,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2888,12 +2889,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: abtestingadvisor diff --git a/.github/workflows/actions-aw-linter-factory.lock.yml b/.github/workflows/actions-aw-linter-factory.lock.yml index 4b46c3f7138..02540b45d7a 100644 --- a/.github/workflows/actions-aw-linter-factory.lock.yml +++ b/.github/workflows/actions-aw-linter-factory.lock.yml @@ -494,6 +494,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2419,12 +2420,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: actionsawlinterfactory diff --git a/.github/workflows/agent-job-health.lock.yml b/.github/workflows/agent-job-health.lock.yml index cdaabe10f12..489f221042a 100644 --- a/.github/workflows/agent-job-health.lock.yml +++ b/.github/workflows/agent-job-health.lock.yml @@ -509,6 +509,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2870,12 +2871,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: agentjobhealth diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml index d5fa8570273..2637c7f050e 100644 --- a/.github/workflows/agent-performance-analyzer.lock.yml +++ b/.github/workflows/agent-performance-analyzer.lock.yml @@ -547,6 +547,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml index 5921e90326e..2c4c285dfe3 100644 --- a/.github/workflows/agent-persona-explorer.lock.yml +++ b/.github/workflows/agent-persona-explorer.lock.yml @@ -545,6 +545,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2894,12 +2895,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: agentpersonaexplorer diff --git a/.github/workflows/agentic-token-audit.lock.yml b/.github/workflows/agentic-token-audit.lock.yml index db88829355d..af9d3f19052 100644 --- a/.github/workflows/agentic-token-audit.lock.yml +++ b/.github/workflows/agentic-token-audit.lock.yml @@ -493,6 +493,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/agentic-token-trend-audit.lock.yml b/.github/workflows/agentic-token-trend-audit.lock.yml index c3929e85162..20defeb0e67 100644 --- a/.github/workflows/agentic-token-trend-audit.lock.yml +++ b/.github/workflows/agentic-token-trend-audit.lock.yml @@ -495,6 +495,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/api-consumption-report.lock.yml b/.github/workflows/api-consumption-report.lock.yml index 062e5be87d1..918abc3172b 100644 --- a/.github/workflows/api-consumption-report.lock.yml +++ b/.github/workflows/api-consumption-report.lock.yml @@ -513,6 +513,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2864,12 +2865,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: apiconsumptionreport diff --git a/.github/workflows/approach-validator.lock.yml b/.github/workflows/approach-validator.lock.yml index b157391b3c3..61a0517bceb 100644 --- a/.github/workflows/approach-validator.lock.yml +++ b/.github/workflows/approach-validator.lock.yml @@ -604,6 +604,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index f82cc4edfdc..01c88294e1b 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -561,6 +561,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/architecture-guardian.lock.yml b/.github/workflows/architecture-guardian.lock.yml index 912b1b5983c..8efcd7bb651 100644 --- a/.github/workflows/architecture-guardian.lock.yml +++ b/.github/workflows/architecture-guardian.lock.yml @@ -498,6 +498,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml b/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml index a2e69e7984f..7f4573ecc98 100644 --- a/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml +++ b/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml @@ -564,6 +564,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml index 8422f4a91ae..7ff4a03d1a1 100644 --- a/.github/workflows/artifacts-summary.lock.yml +++ b/.github/workflows/artifacts-summary.lock.yml @@ -518,6 +518,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml index 346084b0be6..015d5f42ada 100644 --- a/.github/workflows/audit-workflows.lock.yml +++ b/.github/workflows/audit-workflows.lock.yml @@ -560,6 +560,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -3207,12 +3208,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: auditworkflows diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml index fcf5cb4e0e7..6dc28ce72f5 100644 --- a/.github/workflows/auto-triage-issues.lock.yml +++ b/.github/workflows/auto-triage-issues.lock.yml @@ -523,6 +523,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml index 4560936053e..2f406f78a3a 100644 --- a/.github/workflows/avenger.lock.yml +++ b/.github/workflows/avenger.lock.yml @@ -543,6 +543,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/aw-failure-investigator.lock.yml b/.github/workflows/aw-failure-investigator.lock.yml index 61af8294f08..57831a3e6cd 100644 --- a/.github/workflows/aw-failure-investigator.lock.yml +++ b/.github/workflows/aw-failure-investigator.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"76edc703944df67939eb44746ea10b56f61275ded8060f1969b3ae16813ae173","body_hash":"65bdc947090f964fa6d5cd0ba73da2a8a92e497203a1be38f373c4c5e9ea9507","strict":true,"agent_id":"claude","engine_versions":{"claude":"2.1.312"}} -# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"docker/build-push-action","sha":"c3c9e263c25d99ce0380d002d59b67737d91b0dc","version":"v7.4.0"},{"repo":"docker/setup-buildx-action","sha":"f87e5991a6d7451dcb8d9637bfbc97413f497069","version":"v4.4.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"agenticworkflows","tools":["*"]},{"name":"github","tools":["actions_get","actions_list","get_commit","get_file_contents","get_job_logs","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["close_issue","create_issue","link_sub_issue","noop","report_incomplete","report_missing_data","report_missing_tool","update_issue"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"b7ad1dad31e06c5925ef5d2fc7ad053ef454303e","version":"v7.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"},{"repo":"docker/build-push-action","sha":"c3c9e263c25d99ce0380d002d59b67737d91b0dc","version":"v7.4.0"},{"repo":"docker/setup-buildx-action","sha":"f87e5991a6d7451dcb8d9637bfbc97413f497069","version":"v4.4.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"agenticworkflows","tools":["*"]},{"name":"github","tools":["actions_get","actions_list","get_commit","get_file_contents","get_job_logs","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["close_issue","create_issue","link_sub_issue","noop","report_incomplete","report_missing_data","report_missing_tool","update_issue"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -48,6 +48,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -704,10 +705,17 @@ jobs: # Cache configuration from frontmatter processed below - name: Failure investigator prefetch + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: aw-failure-investigator-prefetch-${{ github.run_id }} path: /tmp/gh-aw/agent/failure-investigator + - name: Failure investigator prefetch + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: aw-failure-investigator-prefetch-${{ github.run_id }} + path: /tmp/gh-aw/agent/failure-investigator - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/aw-issue-clustering.lock.yml b/.github/workflows/aw-issue-clustering.lock.yml index a0917a99a59..9bf3372eb5e 100644 --- a/.github/workflows/aw-issue-clustering.lock.yml +++ b/.github/workflows/aw-issue-clustering.lock.yml @@ -473,6 +473,7 @@ jobs: copilot-requests: write discussions: read issues: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index 0eaba7e536c..acb220414fd 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -550,6 +550,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml index 119eb3fd96c..3bd9e795604 100644 --- a/.github/workflows/breaking-change-checker.lock.yml +++ b/.github/workflows/breaking-change-checker.lock.yml @@ -543,6 +543,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml index c48eecc740d..f4ac4108c63 100644 --- a/.github/workflows/changeset.lock.yml +++ b/.github/workflows/changeset.lock.yml @@ -562,6 +562,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml index 75dc89dc87d..07ae4a928a3 100644 --- a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml +++ b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml @@ -500,6 +500,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2344,12 +2345,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: chaosprbundlefuzzer diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml index b991fd65897..02c15e857fd 100644 --- a/.github/workflows/ci-coach.lock.yml +++ b/.github/workflows/ci-coach.lock.yml @@ -574,6 +574,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3025,12 +3026,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: cicoach diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml index 72afd98323b..5bb3df92721 100644 --- a/.github/workflows/claude-code-user-docs-review.lock.yml +++ b/.github/workflows/claude-code-user-docs-review.lock.yml @@ -503,6 +503,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2728,12 +2729,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: claudecodeuserdocsreview diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml index 73bf435b7e2..7680fab5caf 100644 --- a/.github/workflows/cli-consistency-checker.lock.yml +++ b/.github/workflows/cli-consistency-checker.lock.yml @@ -489,6 +489,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml index 73c3cc8bf11..c85a7a0f37f 100644 --- a/.github/workflows/cli-version-checker.lock.yml +++ b/.github/workflows/cli-version-checker.lock.yml @@ -501,6 +501,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2733,12 +2734,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: cliversionchecker diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 4f8a393ebc5..20ded61cb02 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -658,6 +658,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3246,12 +3247,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: cloclo diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml index b8f190d9aa5..0ac174b141f 100644 --- a/.github/workflows/code-scanning-fixer.lock.yml +++ b/.github/workflows/code-scanning-fixer.lock.yml @@ -535,6 +535,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3009,12 +3010,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: codescanningfixer diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml index 7c52669df6d..5162f26db23 100644 --- a/.github/workflows/code-simplifier.lock.yml +++ b/.github/workflows/code-simplifier.lock.yml @@ -532,6 +532,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml index e60de56c435..e776d9802f5 100644 --- a/.github/workflows/commit-changes-analyzer.lock.yml +++ b/.github/workflows/commit-changes-analyzer.lock.yml @@ -548,6 +548,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml index ce3e305ca29..177e78eda14 100644 --- a/.github/workflows/constraint-solving-potd.lock.yml +++ b/.github/workflows/constraint-solving-potd.lock.yml @@ -486,6 +486,7 @@ jobs: permissions: contents: read models: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2679,12 +2680,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: constraintsolvingpotd diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml index 6d10b5f5f73..e6d2d0c3c63 100644 --- a/.github/workflows/contribution-check.lock.yml +++ b/.github/workflows/contribution-check.lock.yml @@ -493,6 +493,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml index cefe0fd40ba..0ffeb117a0f 100644 --- a/.github/workflows/copilot-agent-analysis.lock.yml +++ b/.github/workflows/copilot-agent-analysis.lock.yml @@ -555,6 +555,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3059,12 +3060,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotagentanalysis diff --git a/.github/workflows/copilot-centralization-drilldown.lock.yml b/.github/workflows/copilot-centralization-drilldown.lock.yml index 486f02e2ad7..d27dffc92b2 100644 --- a/.github/workflows/copilot-centralization-drilldown.lock.yml +++ b/.github/workflows/copilot-centralization-drilldown.lock.yml @@ -488,6 +488,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/copilot-centralization-optimizer.lock.yml b/.github/workflows/copilot-centralization-optimizer.lock.yml index 7568eed3f90..f62a5ac72c0 100644 --- a/.github/workflows/copilot-centralization-optimizer.lock.yml +++ b/.github/workflows/copilot-centralization-optimizer.lock.yml @@ -486,6 +486,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml index e845e6be9b4..ebff0dc46f9 100644 --- a/.github/workflows/copilot-cli-deep-research.lock.yml +++ b/.github/workflows/copilot-cli-deep-research.lock.yml @@ -491,6 +491,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/copilot-opt.lock.yml b/.github/workflows/copilot-opt.lock.yml index 773db966df5..d24992011ef 100644 --- a/.github/workflows/copilot-opt.lock.yml +++ b/.github/workflows/copilot-opt.lock.yml @@ -497,6 +497,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2760,12 +2761,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotopt diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml index 07e09942017..f0d76e918f2 100644 --- a/.github/workflows/copilot-pr-merged-report.lock.yml +++ b/.github/workflows/copilot-pr-merged-report.lock.yml @@ -478,6 +478,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2650,12 +2651,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotprmergedreport diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml index 7e0c188ee0b..1674a3a17e2 100644 --- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml +++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml @@ -556,6 +556,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3132,12 +3133,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotprnlpanalysis diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml index 9385890f1ce..5dfe2d10fa2 100644 --- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml +++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml @@ -504,6 +504,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2913,12 +2914,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotprpromptanalysis diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml index 31b26bbdbd7..d72e96c7e77 100644 --- a/.github/workflows/copilot-session-insights.lock.yml +++ b/.github/workflows/copilot-session-insights.lock.yml @@ -527,6 +527,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2957,12 +2958,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: copilotsessioninsights diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index d84657b0d01..50ad8fd76b2 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -547,6 +547,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-action-setup-security-audit.lock.yml b/.github/workflows/daily-action-setup-security-audit.lock.yml index 4791d8ad543..4f1af9db959 100644 --- a/.github/workflows/daily-action-setup-security-audit.lock.yml +++ b/.github/workflows/daily-action-setup-security-audit.lock.yml @@ -487,6 +487,7 @@ jobs: permissions: contents: read issues: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2729,12 +2730,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyactionsetupsecurityaudit diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml index b1387e7caa8..c1e308e71fa 100644 --- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml +++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml @@ -539,6 +539,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml index cfc969c55c5..144c60d95d4 100644 --- a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml +++ b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml @@ -545,6 +545,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3005,12 +3006,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyagentrxtraceoptimizer diff --git a/.github/workflows/daily-ambient-context-optimizer.lock.yml b/.github/workflows/daily-ambient-context-optimizer.lock.yml index d41f9e793f8..2734a596674 100644 --- a/.github/workflows/daily-ambient-context-optimizer.lock.yml +++ b/.github/workflows/daily-ambient-context-optimizer.lock.yml @@ -479,6 +479,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml index 9b1528a6932..2a98e93da75 100644 --- a/.github/workflows/daily-architecture-diagram.lock.yml +++ b/.github/workflows/daily-architecture-diagram.lock.yml @@ -564,6 +564,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -3068,12 +3069,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyarchitecturediagram diff --git a/.github/workflows/daily-arxiv-researcher.lock.yml b/.github/workflows/daily-arxiv-researcher.lock.yml index e746cdc187a..d04bd0cb020 100644 --- a/.github/workflows/daily-arxiv-researcher.lock.yml +++ b/.github/workflows/daily-arxiv-researcher.lock.yml @@ -488,6 +488,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2495,12 +2496,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyarxivresearcher diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index 6789c6717b7..68adb936f4c 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -472,6 +472,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml index a761d1d6999..aef2b82a4d6 100644 --- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml +++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml @@ -566,6 +566,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml index d310bf70b51..62931493f64 100644 --- a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml +++ b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml @@ -491,6 +491,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2730,12 +2731,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyawcrossrepocompilecheck diff --git a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml index 58480dd7779..a604adbd082 100644 --- a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml +++ b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml @@ -481,6 +481,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-byok-ollama-test.lock.yml b/.github/workflows/daily-byok-ollama-test.lock.yml index 6df9837a523..315c0c86c4c 100644 --- a/.github/workflows/daily-byok-ollama-test.lock.yml +++ b/.github/workflows/daily-byok-ollama-test.lock.yml @@ -474,6 +474,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-cache-strategy-analyzer.lock.yml b/.github/workflows/daily-cache-strategy-analyzer.lock.yml index 14707f03ab8..33974c5acdf 100644 --- a/.github/workflows/daily-cache-strategy-analyzer.lock.yml +++ b/.github/workflows/daily-cache-strategy-analyzer.lock.yml @@ -548,6 +548,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -3003,12 +3004,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailycachestrategyanalyzer diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml index 3137c87a4fc..2dba2fda0a9 100644 --- a/.github/workflows/daily-caveman-optimizer.lock.yml +++ b/.github/workflows/daily-caveman-optimizer.lock.yml @@ -561,6 +561,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3317,12 +3318,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailycavemanoptimizer diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml index 3ae43333e2f..3780b35253e 100644 --- a/.github/workflows/daily-choice-test.lock.yml +++ b/.github/workflows/daily-choice-test.lock.yml @@ -478,6 +478,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index 0ca90a974ae..65468f6ceca 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -527,6 +527,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml index fde58567c06..61ca828c159 100644 --- a/.github/workflows/daily-cli-tools-tester.lock.yml +++ b/.github/workflows/daily-cli-tools-tester.lock.yml @@ -491,6 +491,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml index 6be14f82a9c..4c77fd0fc1a 100644 --- a/.github/workflows/daily-code-debt-aider.lock.yml +++ b/.github/workflows/daily-code-debt-aider.lock.yml @@ -505,6 +505,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-aider-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml index 3072766d620..0d0868bc6ee 100644 --- a/.github/workflows/daily-code-metrics.lock.yml +++ b/.github/workflows/daily-code-metrics.lock.yml @@ -538,6 +538,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3200,12 +3201,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailycodemetrics diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml index cee42fac44d..2267834f292 100644 --- a/.github/workflows/daily-community-attribution.lock.yml +++ b/.github/workflows/daily-community-attribution.lock.yml @@ -556,6 +556,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml index 39e79421d97..68dbc230ec1 100644 --- a/.github/workflows/daily-compiler-quality.lock.yml +++ b/.github/workflows/daily-compiler-quality.lock.yml @@ -567,6 +567,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3019,12 +3020,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailycompilerquality diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml index f175c2fd995..0f03bf862e6 100644 --- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml +++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml @@ -510,6 +510,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-credit-limit-test.lock.yml b/.github/workflows/daily-credit-limit-test.lock.yml index da27b8458dd..ac6d78ab28d 100644 --- a/.github/workflows/daily-credit-limit-test.lock.yml +++ b/.github/workflows/daily-credit-limit-test.lock.yml @@ -467,6 +467,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml index dcc81d95f32..d608b90f4c3 100644 --- a/.github/workflows/daily-doc-healer.lock.yml +++ b/.github/workflows/daily-doc-healer.lock.yml @@ -565,6 +565,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3101,12 +3102,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailydochealer diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml index 4e096181a96..32cef114b5d 100644 --- a/.github/workflows/daily-doc-updater.lock.yml +++ b/.github/workflows/daily-doc-updater.lock.yml @@ -564,6 +564,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -3009,12 +3010,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailydocupdater diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml index d03e6ade8ac..99f65b32a04 100644 --- a/.github/workflows/daily-documentation-diagram.lock.yml +++ b/.github/workflows/daily-documentation-diagram.lock.yml @@ -540,6 +540,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2879,12 +2880,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailydocumentationdiagram diff --git a/.github/workflows/daily-ecosystem-explorer.lock.yml b/.github/workflows/daily-ecosystem-explorer.lock.yml index 10045b15456..b7d9b11f303 100644 --- a/.github/workflows/daily-ecosystem-explorer.lock.yml +++ b/.github/workflows/daily-ecosystem-explorer.lock.yml @@ -502,6 +502,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml index 3eae5cf02f3..0a2bda349dd 100644 --- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml +++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml @@ -509,6 +509,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-evals-report.lock.yml b/.github/workflows/daily-evals-report.lock.yml index 47822b48c4c..4dc326aff18 100644 --- a/.github/workflows/daily-evals-report.lock.yml +++ b/.github/workflows/daily-evals-report.lock.yml @@ -516,6 +516,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-experiment-report.lock.yml b/.github/workflows/daily-experiment-report.lock.yml index 8ce4f8bbda2..dc8ea608f5f 100644 --- a/.github/workflows/daily-experiment-report.lock.yml +++ b/.github/workflows/daily-experiment-report.lock.yml @@ -495,6 +495,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2819,12 +2820,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyexperimentreport diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index fdebfb06ff7..49fc89c0a0c 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -537,6 +537,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml index dbd93273743..370c505b744 100644 --- a/.github/workflows/daily-file-diet.lock.yml +++ b/.github/workflows/daily-file-diet.lock.yml @@ -499,6 +499,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml index d17391ec4a4..6f86e47e12d 100644 --- a/.github/workflows/daily-firewall-report.lock.yml +++ b/.github/workflows/daily-firewall-report.lock.yml @@ -525,6 +525,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2862,12 +2863,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyfirewallreport diff --git a/.github/workflows/daily-formal-spec-verifier.lock.yml b/.github/workflows/daily-formal-spec-verifier.lock.yml index 38edfdd419d..612b2783d76 100644 --- a/.github/workflows/daily-formal-spec-verifier.lock.yml +++ b/.github/workflows/daily-formal-spec-verifier.lock.yml @@ -506,6 +506,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2562,12 +2563,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyformalspecverifier diff --git a/.github/workflows/daily-function-namer.lock.yml b/.github/workflows/daily-function-namer.lock.yml index 6fd0bfa83e4..8a2e26c40c7 100644 --- a/.github/workflows/daily-function-namer.lock.yml +++ b/.github/workflows/daily-function-namer.lock.yml @@ -494,6 +494,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2735,12 +2736,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyfunctionnamer diff --git a/.github/workflows/daily-geo-optimizer.lock.yml b/.github/workflows/daily-geo-optimizer.lock.yml index 1bf78b0cbf8..04d570e88f9 100644 --- a/.github/workflows/daily-geo-optimizer.lock.yml +++ b/.github/workflows/daily-geo-optimizer.lock.yml @@ -489,6 +489,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml index c466967396f..a274ad9d0ee 100644 --- a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml +++ b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml @@ -448,6 +448,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml index a644f587b9d..2d5248b1a10 100644 --- a/.github/workflows/daily-go-test-parallelizer.lock.yml +++ b/.github/workflows/daily-go-test-parallelizer.lock.yml @@ -515,6 +515,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2888,12 +2889,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailygotestparallelizer diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml index 2bcadcf083d..39a6f9fb774 100644 --- a/.github/workflows/daily-go-test-stubs-aider.lock.yml +++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml @@ -489,6 +489,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-aider-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-grader-audit.lock.yml b/.github/workflows/daily-grader-audit.lock.yml index 2095c6994b3..3ce904fdb9f 100644 --- a/.github/workflows/daily-grader-audit.lock.yml +++ b/.github/workflows/daily-grader-audit.lock.yml @@ -480,6 +480,7 @@ jobs: permissions: actions: read contents: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-graft-intelligence.lock.yml b/.github/workflows/daily-graft-intelligence.lock.yml index b3b45e6909e..e253bc271e9 100644 --- a/.github/workflows/daily-graft-intelligence.lock.yml +++ b/.github/workflows/daily-graft-intelligence.lock.yml @@ -480,6 +480,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-hippo-learn.lock.yml b/.github/workflows/daily-hippo-learn.lock.yml index 7a4657474c6..6f4c6e60a41 100644 --- a/.github/workflows/daily-hippo-learn.lock.yml +++ b/.github/workflows/daily-hippo-learn.lock.yml @@ -487,6 +487,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2818,12 +2819,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyhippolearn diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml index 5a6f0559075..abd6025ff2a 100644 --- a/.github/workflows/daily-issues-report.lock.yml +++ b/.github/workflows/daily-issues-report.lock.yml @@ -583,6 +583,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3161,12 +3162,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyissuesreport diff --git a/.github/workflows/daily-max-ai-credits-test.lock.yml b/.github/workflows/daily-max-ai-credits-test.lock.yml index 91c2458a896..eb55b8de861 100644 --- a/.github/workflows/daily-max-ai-credits-test.lock.yml +++ b/.github/workflows/daily-max-ai-credits-test.lock.yml @@ -425,6 +425,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml index 80656dc7143..d348c974e7e 100644 --- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml +++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml @@ -494,6 +494,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3176,12 +3177,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailymcpconcurrencyanalysis diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml index 7b7e3b1a08f..6ffec5ce74b 100644 --- a/.github/workflows/daily-model-inventory.lock.yml +++ b/.github/workflows/daily-model-inventory.lock.yml @@ -489,6 +489,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-model-resolution.lock.yml b/.github/workflows/daily-model-resolution.lock.yml index 56db2d972b0..2585571e88a 100644 --- a/.github/workflows/daily-model-resolution.lock.yml +++ b/.github/workflows/daily-model-resolution.lock.yml @@ -490,6 +490,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index 81c8b9f1fe3..5a195425fc0 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -487,6 +487,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml index e07b8bd238b..965e9257359 100644 --- a/.github/workflows/daily-news.lock.yml +++ b/.github/workflows/daily-news.lock.yml @@ -557,6 +557,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -3170,12 +3171,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailynews diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml index a9b6feb5bf4..dc7e511ee44 100644 --- a/.github/workflows/daily-observability-report.lock.yml +++ b/.github/workflows/daily-observability-report.lock.yml @@ -521,6 +521,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index d95af866483..4b621516333 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -497,6 +497,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -3375,12 +3376,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyperformancesummary diff --git a/.github/workflows/daily-pr-review-cursor.lock.yml b/.github/workflows/daily-pr-review-cursor.lock.yml index 2493d8beb2a..2ecfb6fdabc 100644 --- a/.github/workflows/daily-pr-review-cursor.lock.yml +++ b/.github/workflows/daily-pr-review-cursor.lock.yml @@ -482,6 +482,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-regression-audit-kiro.lock.yml b/.github/workflows/daily-regression-audit-kiro.lock.yml index b91ad73ffc9..a914333f9d5 100644 --- a/.github/workflows/daily-regression-audit-kiro.lock.yml +++ b/.github/workflows/daily-regression-audit-kiro.lock.yml @@ -483,6 +483,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml index 53221854116..84a8a9150ca 100644 --- a/.github/workflows/daily-regulatory.lock.yml +++ b/.github/workflows/daily-regulatory.lock.yml @@ -514,6 +514,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-reliability-review.lock.yml b/.github/workflows/daily-reliability-review.lock.yml index 40c16966f85..4c166da8bdc 100644 --- a/.github/workflows/daily-reliability-review.lock.yml +++ b/.github/workflows/daily-reliability-review.lock.yml @@ -488,6 +488,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml index d6fc82eef02..bfe08309699 100644 --- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml +++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml @@ -586,6 +586,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3200,12 +3201,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyrenderingscriptsverifier diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml index e6012f4e269..f8dbda476c1 100644 --- a/.github/workflows/daily-repo-chronicle.lock.yml +++ b/.github/workflows/daily-repo-chronicle.lock.yml @@ -521,6 +521,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2756,12 +2757,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyrepochronicle diff --git a/.github/workflows/daily-report-dispatcher.lock.yml b/.github/workflows/daily-report-dispatcher.lock.yml index 4e6eef3d05e..acc4b7258df 100644 --- a/.github/workflows/daily-report-dispatcher.lock.yml +++ b/.github/workflows/daily-report-dispatcher.lock.yml @@ -494,6 +494,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml index aa5b874054b..f03a15cc238 100644 --- a/.github/workflows/daily-safe-output-integrator.lock.yml +++ b/.github/workflows/daily-safe-output-integrator.lock.yml @@ -505,6 +505,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml index fae9b84ffe6..7c775fcad52 100644 --- a/.github/workflows/daily-safe-output-optimizer.lock.yml +++ b/.github/workflows/daily-safe-output-optimizer.lock.yml @@ -561,6 +561,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3120,12 +3121,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailysafeoutputoptimizer diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml index cba12246406..f66add4bb31 100644 --- a/.github/workflows/daily-safe-outputs-conformance.lock.yml +++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml @@ -487,6 +487,7 @@ jobs: permissions: contents: read issues: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml index 9ae8315d16c..3bfff8373a3 100644 --- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml +++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml @@ -513,6 +513,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-schema-audit-cursor.lock.yml b/.github/workflows/daily-schema-audit-cursor.lock.yml index 28845ed82f8..40c90cc230b 100644 --- a/.github/workflows/daily-schema-audit-cursor.lock.yml +++ b/.github/workflows/daily-schema-audit-cursor.lock.yml @@ -481,6 +481,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml index 518d95a3a3f..c1548a1249e 100644 --- a/.github/workflows/daily-secrets-analysis.lock.yml +++ b/.github/workflows/daily-secrets-analysis.lock.yml @@ -514,6 +514,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2752,12 +2753,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailysecretsanalysis diff --git a/.github/workflows/daily-security-observability.lock.yml b/.github/workflows/daily-security-observability.lock.yml index 55b7057b0dc..d86fd17acfd 100644 --- a/.github/workflows/daily-security-observability.lock.yml +++ b/.github/workflows/daily-security-observability.lock.yml @@ -514,6 +514,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2878,12 +2879,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailysecurityobservability diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml index 479ae14af1a..e29a94775a1 100644 --- a/.github/workflows/daily-security-red-team.lock.yml +++ b/.github/workflows/daily-security-red-team.lock.yml @@ -539,6 +539,7 @@ jobs: copilot-requests: write issues: read security-events: read + cache-mode: read concurrency: group: "gh-aw-opencode-${{ github.workflow }}" queue: max @@ -3264,12 +3265,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailysecurityredteam diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml index 0090c228fd2..a8cc49a7a2d 100644 --- a/.github/workflows/daily-semgrep-scan.lock.yml +++ b/.github/workflows/daily-semgrep-scan.lock.yml @@ -529,6 +529,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-spdd-spec-planner.lock.yml b/.github/workflows/daily-spdd-spec-planner.lock.yml index c78a09046d4..617e0311ca9 100644 --- a/.github/workflows/daily-spdd-spec-planner.lock.yml +++ b/.github/workflows/daily-spdd-spec-planner.lock.yml @@ -487,6 +487,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2740,12 +2741,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyspddspecplanner diff --git a/.github/workflows/daily-spec-coverage-kiro.lock.yml b/.github/workflows/daily-spec-coverage-kiro.lock.yml index e1337a80f7e..92d222d77aa 100644 --- a/.github/workflows/daily-spec-coverage-kiro.lock.yml +++ b/.github/workflows/daily-spec-coverage-kiro.lock.yml @@ -482,6 +482,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-spending-forecast.lock.yml b/.github/workflows/daily-spending-forecast.lock.yml index 64dbdee9c77..71d0d5549eb 100644 --- a/.github/workflows/daily-spending-forecast.lock.yml +++ b/.github/workflows/daily-spending-forecast.lock.yml @@ -486,6 +486,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2862,12 +2863,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyspendingforecast diff --git a/.github/workflows/daily-squid-image-scan.lock.yml b/.github/workflows/daily-squid-image-scan.lock.yml index 3e4af23b1d3..d65c32fbf47 100644 --- a/.github/workflows/daily-squid-image-scan.lock.yml +++ b/.github/workflows/daily-squid-image-scan.lock.yml @@ -464,6 +464,7 @@ jobs: copilot-requests: write issues: read packages: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-storify.lock.yml b/.github/workflows/daily-storify.lock.yml index 72c92a2bf09..df6906dbb56 100644 --- a/.github/workflows/daily-storify.lock.yml +++ b/.github/workflows/daily-storify.lock.yml @@ -514,6 +514,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2968,12 +2969,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailystorify diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml index a21e71a797f..e1c66b102b8 100644 --- a/.github/workflows/daily-syntax-error-quality.lock.yml +++ b/.github/workflows/daily-syntax-error-quality.lock.yml @@ -480,6 +480,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml index 5068c0e618c..123b5d9c86f 100644 --- a/.github/workflows/daily-team-evolution-insights.lock.yml +++ b/.github/workflows/daily-team-evolution-insights.lock.yml @@ -511,6 +511,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 90 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml index afa25b21d7a..0bd74c597e3 100644 --- a/.github/workflows/daily-team-status.lock.yml +++ b/.github/workflows/daily-team-status.lock.yml @@ -478,6 +478,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml index 210c48d6828..8e8be0f0c83 100644 --- a/.github/workflows/daily-testify-uber-super-expert.lock.yml +++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml @@ -512,6 +512,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-token-consumption-report.lock.yml b/.github/workflows/daily-token-consumption-report.lock.yml index 876e458ddf2..00832290095 100644 --- a/.github/workflows/daily-token-consumption-report.lock.yml +++ b/.github/workflows/daily-token-consumption-report.lock.yml @@ -516,6 +516,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml index 7ffab3f895f..4f6a335cd48 100644 --- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml +++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml @@ -515,6 +515,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-vulnhunter-scan.lock.yml b/.github/workflows/daily-vulnhunter-scan.lock.yml index e23df900082..dbd4ce4c714 100644 --- a/.github/workflows/daily-vulnhunter-scan.lock.yml +++ b/.github/workflows/daily-vulnhunter-scan.lock.yml @@ -485,6 +485,7 @@ jobs: actions: read contents: read issues: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-windows-defender-scan.lock.yml b/.github/workflows/daily-windows-defender-scan.lock.yml index 33e6bf6672e..3252a268f61 100644 --- a/.github/workflows/daily-windows-defender-scan.lock.yml +++ b/.github/workflows/daily-windows-defender-scan.lock.yml @@ -490,6 +490,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml index 83ebfb954a0..b5d7772ea53 100644 --- a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml +++ b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml @@ -480,6 +480,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-work-queue-formal-verification.lock.yml b/.github/workflows/daily-work-queue-formal-verification.lock.yml index 8c3961cd46a..c2febe0e949 100644 --- a/.github/workflows/daily-work-queue-formal-verification.lock.yml +++ b/.github/workflows/daily-work-queue-formal-verification.lock.yml @@ -465,6 +465,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-work-queues-report.lock.yml b/.github/workflows/daily-work-queues-report.lock.yml index 0b7b927c7ff..ec271e8e83e 100644 --- a/.github/workflows/daily-work-queues-report.lock.yml +++ b/.github/workflows/daily-work-queues-report.lock.yml @@ -492,6 +492,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-workflow-security-model.lock.yml b/.github/workflows/daily-workflow-security-model.lock.yml index f450824f27e..cea3b1f1fd9 100644 --- a/.github/workflows/daily-workflow-security-model.lock.yml +++ b/.github/workflows/daily-workflow-security-model.lock.yml @@ -483,6 +483,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2428,12 +2429,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dailyworkflowsecuritymodel diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml index f751f0ed703..a1481d77675 100644 --- a/.github/workflows/daily-workflow-updater.lock.yml +++ b/.github/workflows/daily-workflow-updater.lock.yml @@ -499,6 +499,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml index 871a86acd4c..b03d8cba9a0 100644 --- a/.github/workflows/daily-yamllint-fixer.lock.yml +++ b/.github/workflows/daily-yamllint-fixer.lock.yml @@ -521,6 +521,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml index e6b23e51a6c..c48d425cef8 100644 --- a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml +++ b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml @@ -548,6 +548,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3227,12 +3228,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: dataflowprdiscussiondataset diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml index 916932c9bdd..12d2e506650 100644 --- a/.github/workflows/dead-code-remover.lock.yml +++ b/.github/workflows/dead-code-remover.lock.yml @@ -528,6 +528,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2508,12 +2509,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: deadcoderemover diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml index 06d4d17f443..5103e36f288 100644 --- a/.github/workflows/deep-report.lock.yml +++ b/.github/workflows/deep-report.lock.yml @@ -585,6 +585,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3648,12 +3649,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: deepreport diff --git a/.github/workflows/deepsec-security-scan.lock.yml b/.github/workflows/deepsec-security-scan.lock.yml index d30e8deb984..bc62499bba7 100644 --- a/.github/workflows/deepsec-security-scan.lock.yml +++ b/.github/workflows/deepsec-security-scan.lock.yml @@ -516,6 +516,7 @@ jobs: actions: read contents: read issues: read + cache-mode: read timeout-minutes: 90 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml index 9d063b29ee3..56ce743cecc 100644 --- a/.github/workflows/delight.lock.yml +++ b/.github/workflows/delight.lock.yml @@ -492,6 +492,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml index dfa9fa071cf..d17ec058eab 100644 --- a/.github/workflows/dependabot-burner.lock.yml +++ b/.github/workflows/dependabot-burner.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"326f2d69cd952cf8459df2119feadc03ce70a2d3932abb48dab2afeb2bc7e851","body_hash":"092c94df11dbb0dc76937d17d1cd382a6116005b3ecadf5959041d7b543ea272","strict":true,"agent_id":"copilot","agent_model":"gpt-5","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["add_comment","create_pull_request","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["add_comment","create_pull_request","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -45,6 +45,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -703,10 +704,17 @@ jobs: # Cache configuration from frontmatter processed below - name: Dependabot burner selection context + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: dependabot-burner-selection-${{ github.run_id }} path: /tmp/gh-aw/agent/dependabot-burner + - name: Dependabot burner selection context + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: dependabot-burner-selection-${{ github.run_id }} + path: /tmp/gh-aw/agent/dependabot-burner - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml index 240a2fab5d1..82aaced5be2 100644 --- a/.github/workflows/dependabot-go-checker.lock.yml +++ b/.github/workflows/dependabot-go-checker.lock.yml @@ -529,6 +529,7 @@ jobs: pull-requests: read security-events: read vulnerability-alerts: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml index fac0f66ec90..455ec75a14e 100644 --- a/.github/workflows/deployment-incident-monitor.lock.yml +++ b/.github/workflows/deployment-incident-monitor.lock.yml @@ -500,6 +500,7 @@ jobs: actions: read contents: read deployments: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/design-decision-gate.lock.yml b/.github/workflows/design-decision-gate.lock.yml index 1f3ac531829..72a105cae7b 100644 --- a/.github/workflows/design-decision-gate.lock.yml +++ b/.github/workflows/design-decision-gate.lock.yml @@ -582,6 +582,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/designer-drift-audit.lock.yml b/.github/workflows/designer-drift-audit.lock.yml index 8ae60deb8ac..2c62b046252 100644 --- a/.github/workflows/designer-drift-audit.lock.yml +++ b/.github/workflows/designer-drift-audit.lock.yml @@ -475,6 +475,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/detection-analysis-report.lock.yml b/.github/workflows/detection-analysis-report.lock.yml index fe011459534..9872ffb3411 100644 --- a/.github/workflows/detection-analysis-report.lock.yml +++ b/.github/workflows/detection-analysis-report.lock.yml @@ -505,6 +505,7 @@ jobs: contents: read discussions: read issues: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2855,12 +2856,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: detectionanalysisreport diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index e474b3e5cb8..74117fab127 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -525,6 +525,7 @@ jobs: contents: read copilot-requests: write pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml index cf2f85167fa..34464fc0561 100644 --- a/.github/workflows/developer-docs-consolidator.lock.yml +++ b/.github/workflows/developer-docs-consolidator.lock.yml @@ -539,6 +539,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -3093,12 +3094,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: developerdocsconsolidator diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml index 84292a91a53..dea7bd273a4 100644 --- a/.github/workflows/dictation-prompt.lock.yml +++ b/.github/workflows/dictation-prompt.lock.yml @@ -499,6 +499,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index 4111f090efb..4376890c7d8 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -482,6 +482,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml index 4d735b89905..a9d5f7658e0 100644 --- a/.github/workflows/draft-pr-cleanup.lock.yml +++ b/.github/workflows/draft-pr-cleanup.lock.yml @@ -471,6 +471,7 @@ jobs: contents: read copilot-requests: write pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml index 40f216a9050..568721ef717 100644 --- a/.github/workflows/duplicate-code-detector.lock.yml +++ b/.github/workflows/duplicate-code-detector.lock.yml @@ -491,6 +491,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/engine-conformance-dispatcher.lock.yml b/.github/workflows/engine-conformance-dispatcher.lock.yml index 405f3194514..9d9f3ba14c8 100644 --- a/.github/workflows/engine-conformance-dispatcher.lock.yml +++ b/.github/workflows/engine-conformance-dispatcher.lock.yml @@ -496,6 +496,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/eslint-factory-dispatcher.lock.yml b/.github/workflows/eslint-factory-dispatcher.lock.yml index 2312086af0a..6c4e0f8653f 100644 --- a/.github/workflows/eslint-factory-dispatcher.lock.yml +++ b/.github/workflows/eslint-factory-dispatcher.lock.yml @@ -492,6 +492,7 @@ jobs: actions: read contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml index 2251c5145b0..552b502d071 100644 --- a/.github/workflows/eslint-miner.lock.yml +++ b/.github/workflows/eslint-miner.lock.yml @@ -529,6 +529,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 120 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2838,12 +2839,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: eslintminer diff --git a/.github/workflows/eslint-monster.lock.yml b/.github/workflows/eslint-monster.lock.yml index d0910fab8fe..4aa829f86f8 100644 --- a/.github/workflows/eslint-monster.lock.yml +++ b/.github/workflows/eslint-monster.lock.yml @@ -507,6 +507,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/eslint-refiner.lock.yml b/.github/workflows/eslint-refiner.lock.yml index 1290f74201d..0e34c8f622d 100644 --- a/.github/workflows/eslint-refiner.lock.yml +++ b/.github/workflows/eslint-refiner.lock.yml @@ -508,6 +508,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml index 41ecd967be0..7658cece727 100644 --- a/.github/workflows/evoskill-evolver.lock.yml +++ b/.github/workflows/evoskill-evolver.lock.yml @@ -507,6 +507,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2831,12 +2832,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: evoskillevolver diff --git a/.github/workflows/example-failure-category-filter.lock.yml b/.github/workflows/example-failure-category-filter.lock.yml index 1647c5e9ee0..d16578c13c2 100644 --- a/.github/workflows/example-failure-category-filter.lock.yml +++ b/.github/workflows/example-failure-category-filter.lock.yml @@ -472,6 +472,7 @@ jobs: # Permissions for the agent job (workflow permissions default to none). permissions: contents: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml index 32e1ee26bc2..8158955785d 100644 --- a/.github/workflows/example-workflow-analyzer.lock.yml +++ b/.github/workflows/example-workflow-analyzer.lock.yml @@ -488,6 +488,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/feature-grower.lock.yml b/.github/workflows/feature-grower.lock.yml index a107226a814..809eb372a7a 100644 --- a/.github/workflows/feature-grower.lock.yml +++ b/.github/workflows/feature-grower.lock.yml @@ -490,6 +490,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2348,12 +2349,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: featuregrower diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml index f49369a93bb..c10c6e85094 100644 --- a/.github/workflows/firewall-escape.lock.yml +++ b/.github/workflows/firewall-escape.lock.yml @@ -536,6 +536,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2575,12 +2576,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: firewallescape diff --git a/.github/workflows/front-page-copy-guard.lock.yml b/.github/workflows/front-page-copy-guard.lock.yml index d3fc28a3e25..2a5949be615 100644 --- a/.github/workflows/front-page-copy-guard.lock.yml +++ b/.github/workflows/front-page-copy-guard.lock.yml @@ -504,6 +504,7 @@ jobs: contents: read copilot-requests: write pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml index eefc86e74c1..015f9eb33ca 100644 --- a/.github/workflows/functional-pragmatist.lock.yml +++ b/.github/workflows/functional-pragmatist.lock.yml @@ -511,6 +511,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml index 78ed285ee1f..47428bec67b 100644 --- a/.github/workflows/github-mcp-structural-analysis.lock.yml +++ b/.github/workflows/github-mcp-structural-analysis.lock.yml @@ -506,6 +506,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2656,12 +2657,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: githubmcpstructuralanalysis diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml index 0e9aa1edceb..cbecb31f5ad 100644 --- a/.github/workflows/github-mcp-tools-report.lock.yml +++ b/.github/workflows/github-mcp-tools-report.lock.yml @@ -520,6 +520,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2459,12 +2460,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: githubmcptoolsreport diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml index 6995ae87523..35d128c8385 100644 --- a/.github/workflows/github-remote-mcp-auth-test.lock.yml +++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml @@ -480,6 +480,7 @@ jobs: copilot-requests: write discussions: read issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index fc0da83b61c..3252ca20d49 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -541,6 +541,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -3066,12 +3067,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: glossarymaintainer diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml index 57f848d3028..2fb1b26277c 100644 --- a/.github/workflows/go-fan.lock.yml +++ b/.github/workflows/go-fan.lock.yml @@ -548,6 +548,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2969,12 +2970,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: gofan diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 5a517208346..5df4bf57e11 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -520,6 +520,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2857,12 +2858,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: gologger diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml index b8517f6598d..5370d843726 100644 --- a/.github/workflows/go-pattern-detector.lock.yml +++ b/.github/workflows/go-pattern-detector.lock.yml @@ -493,6 +493,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml index 558abeb5397..9bfb7286f02 100644 --- a/.github/workflows/gpclean.lock.yml +++ b/.github/workflows/gpclean.lock.yml @@ -541,6 +541,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2892,12 +2893,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: gpclean diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index 6717c17fdfc..71046257297 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -554,6 +554,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index acbd55c091d..5c81a1d1cc9 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -534,6 +534,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/impeccable-skills-reviewer.lock.yml b/.github/workflows/impeccable-skills-reviewer.lock.yml index 3ac10000713..0d596820a6a 100644 --- a/.github/workflows/impeccable-skills-reviewer.lock.yml +++ b/.github/workflows/impeccable-skills-reviewer.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"be8120ee8cd43e71a65ea89833eb22ba5b3a876f45b0cae6f47519c7c768b698","body_hash":"cd9b235f2eea7a4842c2e9792a9c8a415ebc4b388991cb81c2a67d571e5b3ca4","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-5","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["pbakaus/impeccable/.agents/skills/impeccable@19786e7a225c3688e558f8694a7c8c6a8a25d840"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["pbakaus/impeccable/.agents/skills/impeccable@19786e7a225c3688e558f8694a7c8c6a8a25d840"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -44,6 +44,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -674,12 +675,21 @@ jobs: path: /tmp/gh-aw # Cache configuration from frontmatter processed below - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: /tmp/gh-aw/agent restore-keys: | pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}- + - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-${{ github.run_id }}-${{ github.run_attempt }} + path: /tmp/gh-aw/agent + restore-keys: | + pr-prefetch-v2-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}- - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml index 21ed5743fd4..209fcd5b987 100644 --- a/.github/workflows/instructions-janitor.lock.yml +++ b/.github/workflows/instructions-janitor.lock.yml @@ -515,6 +515,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2448,12 +2449,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: instructionsjanitor diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml index 5e4b65c39f5..3cd64ab67e4 100644 --- a/.github/workflows/issue-arborist.lock.yml +++ b/.github/workflows/issue-arborist.lock.yml @@ -528,6 +528,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index 2efec37e0a1..591bcfa6cf5 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -1005,6 +1005,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index 4b4ace04d99..9447dd02b36 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -473,6 +473,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml index 3716ba77595..bdb1c623143 100644 --- a/.github/workflows/jsweep.lock.yml +++ b/.github/workflows/jsweep.lock.yml @@ -491,6 +491,7 @@ jobs: permissions: actions: read contents: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2385,12 +2386,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: jsweep diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml index 00c783755ea..874e46f6d1d 100644 --- a/.github/workflows/layout-spec-maintainer.lock.yml +++ b/.github/workflows/layout-spec-maintainer.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"54c18bcb686a1f6ba04fcedf7b0e4f9297e5414fecf1f13ea82a0e0fe7acdd62","body_hash":"e524959b8b93d3c190a98475abe3899cd69537794db2bdf4a6b74b9a6932c494","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"safeoutputs","tools":["create_pull_request","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"safeoutputs","tools":["create_pull_request","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -42,6 +42,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -618,11 +619,19 @@ jobs: path: /tmp/gh-aw # Cache configuration from frontmatter processed below - name: Save layout spec data to cache + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: layout-spec-cache-${{ github.run_id }} path: /tmp/gh-aw/agent/layout-cache restore-keys: layout-spec-cache- + - name: Save layout spec data to cache + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: layout-spec-cache-${{ github.run_id }} + path: /tmp/gh-aw/agent/layout-cache + restore-keys: layout-spec-cache- - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/lint-monster.lock.yml b/.github/workflows/lint-monster.lock.yml index 30eddd9e01f..5f9af614344 100644 --- a/.github/workflows/lint-monster.lock.yml +++ b/.github/workflows/lint-monster.lock.yml @@ -487,6 +487,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml index 500d6f56377..d19ebad9b2d 100644 --- a/.github/workflows/linter-miner.lock.yml +++ b/.github/workflows/linter-miner.lock.yml @@ -524,6 +524,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2476,12 +2477,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: linterminer diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml index 8170793037e..753fec6419d 100644 --- a/.github/workflows/lockfile-stats.lock.yml +++ b/.github/workflows/lockfile-stats.lock.yml @@ -490,6 +490,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2306,12 +2307,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: lockfilestats diff --git a/.github/workflows/mattpocock-skills-reviewer.lock.yml b/.github/workflows/mattpocock-skills-reviewer.lock.yml index a9112b90b46..4a2651f39f6 100644 --- a/.github/workflows/mattpocock-skills-reviewer.lock.yml +++ b/.github/workflows/mattpocock-skills-reviewer.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"4b87954de14b41b8efff2f00b0fe7ad7551ebd43af42451d254f6e98ab8e0bc2","body_hash":"5ef9335cf9dc1c41708d3b3768cc3792b3dc8c60af6f1fc56c3d7157cd7036b9","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-5","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["mattpocock/skills/codebase-design@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/diagnosing-bugs@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/grill-with-docs@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/improve-codebase-architecture@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/tdd@49dd158d1076134a641b33efb035946536778336"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["mattpocock/skills/codebase-design@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/diagnosing-bugs@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/grill-with-docs@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/improve-codebase-architecture@49dd158d1076134a641b33efb035946536778336","mattpocock/skills/tdd@49dd158d1076134a641b33efb035946536778336"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -43,6 +43,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -778,12 +779,21 @@ jobs: path: /tmp/gh-aw # Cache configuration from frontmatter processed below - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} path: /tmp/gh-aw/agent restore-keys: | pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} + - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} + path: /tmp/gh-aw/agent + restore-keys: | + pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml index 60f696e6516..63d3a914fe2 100644 --- a/.github/workflows/mcp-inspector.lock.yml +++ b/.github/workflows/mcp-inspector.lock.yml @@ -529,6 +529,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2833,12 +2834,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: mcpinspector diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml index 1342da533fb..9521d2c71c0 100644 --- a/.github/workflows/mergefest.lock.yml +++ b/.github/workflows/mergefest.lock.yml @@ -548,6 +548,7 @@ jobs: actions: read contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml index d00562dbd57..c16c3baf9fa 100644 --- a/.github/workflows/metrics-collector.lock.yml +++ b/.github/workflows/metrics-collector.lock.yml @@ -499,6 +499,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/necromancer.lock.yml b/.github/workflows/necromancer.lock.yml index 4b50ae91efc..b1765303e55 100644 --- a/.github/workflows/necromancer.lock.yml +++ b/.github/workflows/necromancer.lock.yml @@ -567,6 +567,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/objective-impact-report.lock.yml b/.github/workflows/objective-impact-report.lock.yml index fe1b991ab54..616186b2eba 100644 --- a/.github/workflows/objective-impact-report.lock.yml +++ b/.github/workflows/objective-impact-report.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"8d45320ce38f441a165a41ac573fa73881dc43a8840a353356de18ff0ca06341","body_hash":"a66c7952cb6e7fc02028bae75e758df0112f7a54cefff838e2c5dcb28c7e481a","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"safeoutputs","tools":["close_issue","create_issue","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_DEFAULT_OTLP_ENDPOINT","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"mcp_servers":[{"name":"safeoutputs","tools":["close_issue","create_issue","noop","report_incomplete","report_missing_data","report_missing_tool"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -38,6 +38,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -585,11 +586,19 @@ jobs: path: /tmp/gh-aw # Cache configuration from frontmatter processed below - name: Save objective impact report dataset cache + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: objective-impact-report-cache-${{ github.run_id }} path: /tmp/gh-aw/agent/objective-impact-report restore-keys: objective-impact-report-cache- + - name: Save objective impact report dataset cache + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: objective-impact-report-cache-${{ github.run_id }} + path: /tmp/gh-aw/agent/objective-impact-report + restore-keys: objective-impact-report-cache- - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml index 7b2ac608bd3..918b09908d9 100644 --- a/.github/workflows/org-health-report.lock.yml +++ b/.github/workflows/org-health-report.lock.yml @@ -502,6 +502,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2388,12 +2389,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: orghealthreport diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index ced783eb243..c5bea390ae4 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -583,6 +583,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2501,12 +2502,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: pdfsummary diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml index eaed74f31e7..bd190ba01e8 100644 --- a/.github/workflows/plan.lock.yml +++ b/.github/workflows/plan.lock.yml @@ -600,6 +600,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml index 084171387ce..fdb1886195d 100644 --- a/.github/workflows/poem-bot.lock.yml +++ b/.github/workflows/poem-bot.lock.yml @@ -569,6 +569,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3261,12 +3262,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: poembot diff --git a/.github/workflows/ponytail-reviewer.lock.yml b/.github/workflows/ponytail-reviewer.lock.yml index 233abf065d4..94902c18703 100644 --- a/.github/workflows/ponytail-reviewer.lock.yml +++ b/.github/workflows/ponytail-reviewer.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"27c79195ab7529356c5858163c42c5174c53a855b09849621cdccb4b89105c69","body_hash":"5bbf29c8bdec373cf68befed46bd04a57a9c8d86c26106c4cd55e5c23c42c7ff","strict":true,"agent_id":"codex","agent_model":"openai/gpt-5.6-terra","engine_versions":{"codex":"0.165.0"}} -# gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["DietrichGebert/ponytail/skills/ponytail-review@09c434ab73ca43761c5d8b0c5d341926c2fba710"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"skills":["DietrichGebert/ponytail/skills/ponytail-review@09c434ab73ca43761c5d8b0c5d341926c2fba710"],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -45,6 +45,7 @@ # - OPENAI_API_KEY # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -710,12 +711,21 @@ jobs: path: /tmp/gh-aw # Cache configuration from frontmatter processed below - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} path: /tmp/gh-aw/agent restore-keys: | pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} + - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} + path: /tmp/gh-aw/agent + restore-keys: | + pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml index b43742b6c98..3228283df38 100644 --- a/.github/workflows/portfolio-analyst.lock.yml +++ b/.github/workflows/portfolio-analyst.lock.yml @@ -502,6 +502,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2481,12 +2482,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: portfolioanalyst diff --git a/.github/workflows/pr-code-quality-reviewer.lock.yml b/.github/workflows/pr-code-quality-reviewer.lock.yml index 82b456939dd..906289554e1 100644 --- a/.github/workflows/pr-code-quality-reviewer.lock.yml +++ b/.github/workflows/pr-code-quality-reviewer.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"8009c5eec04c98445dcba7823a4fc49e14dbb2267e7122e00a78162fd2e7d673","body_hash":"4ca40ffb96ba078c06fd9b549349765c4cb72a760b472ba13a7af66980efe78a","strict":true,"agent_id":"copilot","agent_model":"copilot/gpt-5","engine_versions":{"copilot":"1.0.103","copilot-sdk":"1.0.16"}} -# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["create_check_run","create_pull_request_review_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -43,6 +43,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -689,12 +690,21 @@ jobs: await main(); # Cache configuration from frontmatter processed below - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} path: /tmp/gh-aw/agent restore-keys: | pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} + - name: Cache (pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }}) + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha || 'unknown' }}-${{ github.run_id }}-${{ github.run_attempt }} + path: /tmp/gh-aw/agent + restore-keys: | + pr-prefetch-v2-${{ github.event.pull_request.number || github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}-${{ github.event.pull_request.head.sha && format('{0}-', github.event.pull_request.head.sha) || '' }} - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/pr-description-caveman.lock.yml b/.github/workflows/pr-description-caveman.lock.yml index 4037bc490d1..1e6b9feccec 100644 --- a/.github/workflows/pr-description-caveman.lock.yml +++ b/.github/workflows/pr-description-caveman.lock.yml @@ -515,6 +515,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml index b90cf511050..884a8752058 100644 --- a/.github/workflows/pr-nitpick-reviewer.lock.yml +++ b/.github/workflows/pr-nitpick-reviewer.lock.yml @@ -558,6 +558,7 @@ jobs: actions: read contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/pr-sous-chef.lock.yml b/.github/workflows/pr-sous-chef.lock.yml index 4c532e9a7c0..19ba0083038 100644 --- a/.github/workflows/pr-sous-chef.lock.yml +++ b/.github/workflows/pr-sous-chef.lock.yml @@ -495,6 +495,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml index a7cfb06c8ae..32b45633441 100644 --- a/.github/workflows/pr-triage-agent.lock.yml +++ b/.github/workflows/pr-triage-agent.lock.yml @@ -500,6 +500,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml index 8357bb180a7..880eb4d9c5d 100644 --- a/.github/workflows/prompt-clustering-analysis.lock.yml +++ b/.github/workflows/prompt-clustering-analysis.lock.yml @@ -714,11 +714,19 @@ jobs: # Cache configuration from frontmatter processed below - name: Save prompt clustering data to cache + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: prompt-clustering-cache-${{ github.run_id }} path: /tmp/gh-aw/agent/prompt-cache restore-keys: prompt-clustering-cache- + - name: Save prompt clustering data to cache + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: prompt-clustering-cache-${{ github.run_id }} + path: /tmp/gh-aw/agent/prompt-cache + restore-keys: prompt-clustering-cache- - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} @@ -2470,12 +2478,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: promptclusteringanalysis diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml index 7e01cd9e19e..99964b25b61 100644 --- a/.github/workflows/purelock.lock.yml +++ b/.github/workflows/purelock.lock.yml @@ -535,6 +535,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -3162,12 +3163,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: purelock diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml index 7ad9bcb6888..d17c93b08ef 100644 --- a/.github/workflows/python-data-charts.lock.yml +++ b/.github/workflows/python-data-charts.lock.yml @@ -504,6 +504,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2432,12 +2433,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: pythondatacharts diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index 08a321d72ba..ee70e9dcb6a 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -611,6 +611,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/refactoring-cadence.lock.yml b/.github/workflows/refactoring-cadence.lock.yml index 7ba716ab02d..a8aa3a9b85c 100644 --- a/.github/workflows/refactoring-cadence.lock.yml +++ b/.github/workflows/refactoring-cadence.lock.yml @@ -498,6 +498,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2326,12 +2327,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: refactoringcadence diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index 7213186f91e..fda3d4eeeed 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -563,6 +563,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml index 234677273a0..0f16b35c278 100644 --- a/.github/workflows/repo-audit-analyzer.lock.yml +++ b/.github/workflows/repo-audit-analyzer.lock.yml @@ -500,6 +500,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2731,12 +2732,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: repoauditanalyzer diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml index e9a0e96680e..db566ded259 100644 --- a/.github/workflows/repo-tree-map.lock.yml +++ b/.github/workflows/repo-tree-map.lock.yml @@ -498,6 +498,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml index 03361e9850b..e024a31ae56 100644 --- a/.github/workflows/repository-quality-improver.lock.yml +++ b/.github/workflows/repository-quality-improver.lock.yml @@ -500,6 +500,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2289,12 +2290,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: repositoryqualityimprover diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml index 81065b13bcc..54d2746e730 100644 --- a/.github/workflows/research.lock.yml +++ b/.github/workflows/research.lock.yml @@ -483,6 +483,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml index 1b7326ec349..e6a0d628eb6 100644 --- a/.github/workflows/safe-output-health.lock.yml +++ b/.github/workflows/safe-output-health.lock.yml @@ -499,6 +499,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2411,12 +2412,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: safeoutputhealth diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml index 73ffd1fdd3e..b2754f78fb6 100644 --- a/.github/workflows/schema-consistency-checker.lock.yml +++ b/.github/workflows/schema-consistency-checker.lock.yml @@ -494,6 +494,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2279,12 +2280,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: schemaconsistencychecker diff --git a/.github/workflows/schema-feature-coverage.lock.yml b/.github/workflows/schema-feature-coverage.lock.yml index 14b81167f4f..b2dca531d90 100644 --- a/.github/workflows/schema-feature-coverage.lock.yml +++ b/.github/workflows/schema-feature-coverage.lock.yml @@ -483,6 +483,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 33a3313d5c3..d0ccd9678d4 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -594,6 +594,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2598,12 +2599,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: scout diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml index 5ff062b9d69..5b0ab9e560b 100644 --- a/.github/workflows/security-compliance.lock.yml +++ b/.github/workflows/security-compliance.lock.yml @@ -513,6 +513,7 @@ jobs: permissions: contents: read security-events: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml index 39a6a04d6f1..eefa5f9b094 100644 --- a/.github/workflows/security-review.lock.yml +++ b/.github/workflows/security-review.lock.yml @@ -565,6 +565,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml index 2308f5238b4..a4b703e8124 100644 --- a/.github/workflows/semantic-function-refactor.lock.yml +++ b/.github/workflows/semantic-function-refactor.lock.yml @@ -483,6 +483,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml index 93a261203e3..9bc3a240fb2 100644 --- a/.github/workflows/sergo.lock.yml +++ b/.github/workflows/sergo.lock.yml @@ -507,6 +507,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/sighthound-security-scan.lock.yml b/.github/workflows/sighthound-security-scan.lock.yml index f0a758dc38b..47ba1f6cc9a 100644 --- a/.github/workflows/sighthound-security-scan.lock.yml +++ b/.github/workflows/sighthound-security-scan.lock.yml @@ -471,6 +471,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/skillet.lock.yml b/.github/workflows/skillet.lock.yml index 582aee03473..633c15c2db2 100644 --- a/.github/workflows/skillet.lock.yml +++ b/.github/workflows/skillet.lock.yml @@ -579,6 +579,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index 5503258fce9..e3072f9fe94 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -544,6 +544,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}-${{ inputs.focus || github.run_id }}" queue: max @@ -2603,12 +2604,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: slidedeckmaintainer diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml index 2dd39c8f991..a108890deb1 100644 --- a/.github/workflows/smoke-agent-all-merged.lock.yml +++ b/.github/workflows/smoke-agent-all-merged.lock.yml @@ -560,6 +560,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml index 7f419be81dc..49562283941 100644 --- a/.github/workflows/smoke-agent-all-none.lock.yml +++ b/.github/workflows/smoke-agent-all-none.lock.yml @@ -558,6 +558,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml index b1538a572cf..7dc4f470b7d 100644 --- a/.github/workflows/smoke-agent-public-approved.lock.yml +++ b/.github/workflows/smoke-agent-public-approved.lock.yml @@ -563,6 +563,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml index 92a9e94f333..0fb98a71ad7 100644 --- a/.github/workflows/smoke-agent-public-none.lock.yml +++ b/.github/workflows/smoke-agent-public-none.lock.yml @@ -558,6 +558,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml index f49c07402f5..89855c4735c 100644 --- a/.github/workflows/smoke-agent-scoped-approved.lock.yml +++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml @@ -564,6 +564,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-aider.lock.yml b/.github/workflows/smoke-aider.lock.yml index d46f4ac1b83..541c9036355 100644 --- a/.github/workflows/smoke-aider.lock.yml +++ b/.github/workflows/smoke-aider.lock.yml @@ -558,6 +558,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-builtin-ledgers.lock.yml b/.github/workflows/smoke-builtin-ledgers.lock.yml index 04f49d7c027..eb97cc0c03c 100644 --- a/.github/workflows/smoke-builtin-ledgers.lock.yml +++ b/.github/workflows/smoke-builtin-ledgers.lock.yml @@ -471,6 +471,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml index f942da31226..559e12c81bd 100644 --- a/.github/workflows/smoke-call-workflow.lock.yml +++ b/.github/workflows/smoke-call-workflow.lock.yml @@ -559,6 +559,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml index ceef19c99b0..67b5aa81993 100644 --- a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml +++ b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml @@ -566,6 +566,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-claude-dynamic.lock.yml b/.github/workflows/smoke-claude-dynamic.lock.yml index 599d3f42e25..dfe67a51bf1 100644 --- a/.github/workflows/smoke-claude-dynamic.lock.yml +++ b/.github/workflows/smoke-claude-dynamic.lock.yml @@ -465,6 +465,7 @@ jobs: # Permissions for the agent job (workflow permissions default to none). permissions: contents: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-claude-on-copilot.lock.yml b/.github/workflows/smoke-claude-on-copilot.lock.yml index 3a34a1f7b11..2df4ab7b66d 100644 --- a/.github/workflows/smoke-claude-on-copilot.lock.yml +++ b/.github/workflows/smoke-claude-on-copilot.lock.yml @@ -539,6 +539,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-claude-routed.lock.yml b/.github/workflows/smoke-claude-routed.lock.yml index 33793b1eccb..435af75de53 100644 --- a/.github/workflows/smoke-claude-routed.lock.yml +++ b/.github/workflows/smoke-claude-routed.lock.yml @@ -531,6 +531,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index d8caa81c3ab..859fa9a2626 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -600,6 +600,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3376,12 +3377,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokeclaude diff --git a/.github/workflows/smoke-codex-routed.lock.yml b/.github/workflows/smoke-codex-routed.lock.yml index 5cf15ee0c1e..fc2dcba1644 100644 --- a/.github/workflows/smoke-codex-routed.lock.yml +++ b/.github/workflows/smoke-codex-routed.lock.yml @@ -511,6 +511,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index e256c5c55be..83f6bcb4333 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -599,6 +599,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3200,12 +3201,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecodex diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 200c2bf101e..d99a317454b 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -660,6 +660,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -4493,12 +4494,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotaoaiapikey diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index aa3d47e0340..b981e428ff2 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -666,6 +666,7 @@ jobs: id-token: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -4522,12 +4523,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotaoaientra diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index 16dd20612ea..2c677dffb63 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -597,6 +597,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3732,12 +3733,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilotarm diff --git a/.github/workflows/smoke-copilot-auto.lock.yml b/.github/workflows/smoke-copilot-auto.lock.yml index 9afdfc0a977..5095945037c 100644 --- a/.github/workflows/smoke-copilot-auto.lock.yml +++ b/.github/workflows/smoke-copilot-auto.lock.yml @@ -541,6 +541,7 @@ jobs: contents: read copilot-requests: write pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml b/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml index 725dcb0ce1c..6d8bbe396dc 100644 --- a/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml +++ b/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml @@ -537,6 +537,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-mai.lock.yml b/.github/workflows/smoke-copilot-mai.lock.yml index 471ac123096..53f31d46b33 100644 --- a/.github/workflows/smoke-copilot-mai.lock.yml +++ b/.github/workflows/smoke-copilot-mai.lock.yml @@ -575,6 +575,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-copilot-routed-claude.lock.yml b/.github/workflows/smoke-copilot-routed-claude.lock.yml index 5600b8973a9..1922b997eff 100644 --- a/.github/workflows/smoke-copilot-routed-claude.lock.yml +++ b/.github/workflows/smoke-copilot-routed-claude.lock.yml @@ -549,6 +549,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-routed-steering.lock.yml b/.github/workflows/smoke-copilot-routed-steering.lock.yml index c265824977c..b87a0b45388 100644 --- a/.github/workflows/smoke-copilot-routed-steering.lock.yml +++ b/.github/workflows/smoke-copilot-routed-steering.lock.yml @@ -549,6 +549,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-routed.lock.yml b/.github/workflows/smoke-copilot-routed.lock.yml index f544ba46e4c..373a6277a55 100644 --- a/.github/workflows/smoke-copilot-routed.lock.yml +++ b/.github/workflows/smoke-copilot-routed.lock.yml @@ -532,6 +532,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml b/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml index 63ce0c42fc8..157ded8e150 100644 --- a/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml +++ b/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml @@ -548,6 +548,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-sdk-routed.lock.yml b/.github/workflows/smoke-copilot-sdk-routed.lock.yml index 1ba53632be7..ce5dedf6135 100644 --- a/.github/workflows/smoke-copilot-sdk-routed.lock.yml +++ b/.github/workflows/smoke-copilot-sdk-routed.lock.yml @@ -531,6 +531,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-copilot-sdk.lock.yml b/.github/workflows/smoke-copilot-sdk.lock.yml index 3528b588e05..9578de1196c 100644 --- a/.github/workflows/smoke-copilot-sdk.lock.yml +++ b/.github/workflows/smoke-copilot-sdk.lock.yml @@ -571,6 +571,7 @@ jobs: # Permissions for the agent job (workflow permissions default to none). permissions: contents: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-copilot-small.lock.yml b/.github/workflows/smoke-copilot-small.lock.yml index c4e04a3ce5b..d0267397f45 100644 --- a/.github/workflows/smoke-copilot-small.lock.yml +++ b/.github/workflows/smoke-copilot-small.lock.yml @@ -573,6 +573,7 @@ jobs: # Permissions for the agent job (workflow permissions default to none). permissions: contents: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-copilot-sub-agents.lock.yml b/.github/workflows/smoke-copilot-sub-agents.lock.yml index d2930a94d2a..3e92244cfda 100644 --- a/.github/workflows/smoke-copilot-sub-agents.lock.yml +++ b/.github/workflows/smoke-copilot-sub-agents.lock.yml @@ -520,6 +520,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index d2949e6618c..4fbaa78328d 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -670,6 +670,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -4508,12 +4509,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilot diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml index 955c7de53fe..4ab7c49ab34 100644 --- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml @@ -562,6 +562,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-crush.lock.yml b/.github/workflows/smoke-crush.lock.yml index 9d9f4d7d2be..a6a8ca9ba45 100644 --- a/.github/workflows/smoke-crush.lock.yml +++ b/.github/workflows/smoke-crush.lock.yml @@ -567,6 +567,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-cursor.lock.yml b/.github/workflows/smoke-cursor.lock.yml index 7964408f4b3..fa344d99ed7 100644 --- a/.github/workflows/smoke-cursor.lock.yml +++ b/.github/workflows/smoke-cursor.lock.yml @@ -573,6 +573,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-deepseek-harness.lock.yml b/.github/workflows/smoke-deepseek-harness.lock.yml index 091bf2b04f2..e3d37e8b604 100644 --- a/.github/workflows/smoke-deepseek-harness.lock.yml +++ b/.github/workflows/smoke-deepseek-harness.lock.yml @@ -577,6 +577,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2638,12 +2639,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokedeepseekharness diff --git a/.github/workflows/smoke-drive.lock.yml b/.github/workflows/smoke-drive.lock.yml index ca91d3329a1..e61c6a5d820 100644 --- a/.github/workflows/smoke-drive.lock.yml +++ b/.github/workflows/smoke-drive.lock.yml @@ -570,6 +570,7 @@ jobs: id-token: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2612,7 +2613,9 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' runs-on: ubuntu-latest # Permissions for the update_drive_memory job (workflow permissions default to none). permissions: diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml index fa2e850c16e..a3dbcec1838 100644 --- a/.github/workflows/smoke-gemini.lock.yml +++ b/.github/workflows/smoke-gemini.lock.yml @@ -627,6 +627,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3134,12 +3135,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokegemini diff --git a/.github/workflows/smoke-github-claude.lock.yml b/.github/workflows/smoke-github-claude.lock.yml index 5f113f145c6..1b3638045ae 100644 --- a/.github/workflows/smoke-github-claude.lock.yml +++ b/.github/workflows/smoke-github-claude.lock.yml @@ -545,6 +545,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-goose.lock.yml b/.github/workflows/smoke-goose.lock.yml index 2043afa413e..276e5e85d2f 100644 --- a/.github/workflows/smoke-goose.lock.yml +++ b/.github/workflows/smoke-goose.lock.yml @@ -576,6 +576,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2886,12 +2887,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokegoose diff --git a/.github/workflows/smoke-issues.lock.yml b/.github/workflows/smoke-issues.lock.yml index f4daf05663c..2c707be3f4b 100644 --- a/.github/workflows/smoke-issues.lock.yml +++ b/.github/workflows/smoke-issues.lock.yml @@ -499,6 +499,7 @@ jobs: permissions: actions: read contents: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-kiro.lock.yml b/.github/workflows/smoke-kiro.lock.yml index 2445aafeacb..77a0951b2f5 100644 --- a/.github/workflows/smoke-kiro.lock.yml +++ b/.github/workflows/smoke-kiro.lock.yml @@ -574,6 +574,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml index a5893862eeb..9bfa7f7fe40 100644 --- a/.github/workflows/smoke-multi-pr.lock.yml +++ b/.github/workflows/smoke-multi-pr.lock.yml @@ -560,6 +560,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml index 9c71b20fd74..240381890a8 100644 --- a/.github/workflows/smoke-opencode.lock.yml +++ b/.github/workflows/smoke-opencode.lock.yml @@ -585,6 +585,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2820,12 +2821,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokeopencode diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml index 2cb07b19078..fa2e6860f22 100644 --- a/.github/workflows/smoke-otel-backends.lock.yml +++ b/.github/workflows/smoke-otel-backends.lock.yml @@ -595,6 +595,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-pi-routed-claude.lock.yml b/.github/workflows/smoke-pi-routed-claude.lock.yml index ead4492f677..980a6d44aea 100644 --- a/.github/workflows/smoke-pi-routed-claude.lock.yml +++ b/.github/workflows/smoke-pi-routed-claude.lock.yml @@ -544,6 +544,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-pi-routed.lock.yml b/.github/workflows/smoke-pi-routed.lock.yml index 9d8d1659993..beb387d7a7f 100644 --- a/.github/workflows/smoke-pi-routed.lock.yml +++ b/.github/workflows/smoke-pi-routed.lock.yml @@ -547,6 +547,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}-${{ github.run_id }}" queue: max diff --git a/.github/workflows/smoke-pi-sub-agents.lock.yml b/.github/workflows/smoke-pi-sub-agents.lock.yml index d0cf0e23de8..9f815b49c0c 100644 --- a/.github/workflows/smoke-pi-sub-agents.lock.yml +++ b/.github/workflows/smoke-pi-sub-agents.lock.yml @@ -464,6 +464,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-pi.lock.yml b/.github/workflows/smoke-pi.lock.yml index 5524ad420a4..414dc0839ac 100644 --- a/.github/workflows/smoke-pi.lock.yml +++ b/.github/workflows/smoke-pi.lock.yml @@ -574,6 +574,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2534,12 +2535,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokepi diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index 06dee096067..352bee690f8 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -634,6 +634,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-pydantic.lock.yml b/.github/workflows/smoke-pydantic.lock.yml index 7df992e8174..273482749c5 100644 --- a/.github/workflows/smoke-pydantic.lock.yml +++ b/.github/workflows/smoke-pydantic.lock.yml @@ -559,6 +559,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-repo-memory-ledger.lock.yml b/.github/workflows/smoke-repo-memory-ledger.lock.yml index aea95dc1cb7..bb2a6015395 100644 --- a/.github/workflows/smoke-repo-memory-ledger.lock.yml +++ b/.github/workflows/smoke-repo-memory-ledger.lock.yml @@ -475,6 +475,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-security-alerts.lock.yml b/.github/workflows/smoke-security-alerts.lock.yml index 229ad1cf28e..675d60a4a4a 100644 --- a/.github/workflows/smoke-security-alerts.lock.yml +++ b/.github/workflows/smoke-security-alerts.lock.yml @@ -500,6 +500,7 @@ jobs: copilot-requests: write security-events: read vulnerability-alerts: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-service-ports.lock.yml b/.github/workflows/smoke-service-ports.lock.yml index d8d76bbeabb..97772a09d67 100644 --- a/.github/workflows/smoke-service-ports.lock.yml +++ b/.github/workflows/smoke-service-ports.lock.yml @@ -548,6 +548,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml index 76d09da962e..8e1d334f56b 100644 --- a/.github/workflows/smoke-temporary-id.lock.yml +++ b/.github/workflows/smoke-temporary-id.lock.yml @@ -598,6 +598,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml index 5bfe62cdd02..6c8d6170cd3 100644 --- a/.github/workflows/smoke-test-tools.lock.yml +++ b/.github/workflows/smoke-test-tools.lock.yml @@ -560,6 +560,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml index 42b743860c3..22caa503043 100644 --- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml @@ -571,6 +571,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -2726,12 +2727,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokeupdatecrossrepopr diff --git a/.github/workflows/smoke-work-queue.lock.yml b/.github/workflows/smoke-work-queue.lock.yml index 5c43222765f..247bdfb1cc0 100644 --- a/.github/workflows/smoke-work-queue.lock.yml +++ b/.github/workflows/smoke-work-queue.lock.yml @@ -485,6 +485,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index fc119541a86..e9f9a98f1b8 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -581,6 +581,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-smoke-workflow-call-with-inputs" queue: max diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index 3bab6347cc3..b1120dce7e5 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -573,6 +573,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-smoke-workflow-call" queue: max diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml index e526fc022ba..b2f3ba70127 100644 --- a/.github/workflows/spec-enforcer.lock.yml +++ b/.github/workflows/spec-enforcer.lock.yml @@ -535,6 +535,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2901,12 +2902,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: specenforcer diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml index b5130f60ec5..8514cac1d48 100644 --- a/.github/workflows/spec-extractor.lock.yml +++ b/.github/workflows/spec-extractor.lock.yml @@ -520,6 +520,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max @@ -2483,12 +2484,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: specextractor diff --git a/.github/workflows/spec-librarian.lock.yml b/.github/workflows/spec-librarian.lock.yml index 86f84518f2a..c2c98df35fa 100644 --- a/.github/workflows/spec-librarian.lock.yml +++ b/.github/workflows/spec-librarian.lock.yml @@ -499,6 +499,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/squad-game-planner.lock.yml b/.github/workflows/squad-game-planner.lock.yml index 19dbfcb0091..241b439c1b2 100644 --- a/.github/workflows/squad-game-planner.lock.yml +++ b/.github/workflows/squad-game-planner.lock.yml @@ -515,6 +515,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/squad-implement-worker.lock.yml b/.github/workflows/squad-implement-worker.lock.yml index 031485fe7d3..780c2705a6d 100644 --- a/.github/workflows/squad-implement-worker.lock.yml +++ b/.github/workflows/squad-implement-worker.lock.yml @@ -565,6 +565,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/squad-plan.lock.yml b/.github/workflows/squad-plan.lock.yml index a77bca11911..b4f2d65261c 100644 --- a/.github/workflows/squad-plan.lock.yml +++ b/.github/workflows/squad-plan.lock.yml @@ -582,6 +582,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/squad.lock.yml b/.github/workflows/squad.lock.yml index 9e9de0714bd..e1fa83c0dc2 100644 --- a/.github/workflows/squad.lock.yml +++ b/.github/workflows/squad.lock.yml @@ -609,6 +609,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/stale-pr-cleanup.lock.yml b/.github/workflows/stale-pr-cleanup.lock.yml index 1dec614b2cc..d871a620de4 100644 --- a/.github/workflows/stale-pr-cleanup.lock.yml +++ b/.github/workflows/stale-pr-cleanup.lock.yml @@ -474,6 +474,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml index b1b87ffb704..3b793213f85 100644 --- a/.github/workflows/stale-repo-identifier.lock.yml +++ b/.github/workflows/stale-repo-identifier.lock.yml @@ -513,6 +513,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}-${{ inputs.organization || github.run_id }}" queue: max @@ -2910,12 +2911,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: stalerepoidentifier diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml index 45c42516208..d0d65e6a550 100644 --- a/.github/workflows/static-analysis-report.lock.yml +++ b/.github/workflows/static-analysis-report.lock.yml @@ -504,6 +504,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2550,12 +2551,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: staticanalysisreport diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml index ae8211b8a9e..2f6f1fd3d7a 100644 --- a/.github/workflows/step-name-alignment.lock.yml +++ b/.github/workflows/step-name-alignment.lock.yml @@ -491,6 +491,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max @@ -2317,12 +2318,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: stepnamealignment diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index 676e67c8275..6a47e3bb703 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -472,6 +472,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml index 825ab0b6faf..389411b2645 100644 --- a/.github/workflows/super-linter.lock.yml +++ b/.github/workflows/super-linter.lock.yml @@ -493,6 +493,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2358,12 +2359,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: superlinter diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 90ddbb9be43..8d1b1215d0c 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -541,6 +541,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3078,12 +3079,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: technicaldocwriter diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml index 472cd79478a..432a66efe83 100644 --- a/.github/workflows/terminal-stylist.lock.yml +++ b/.github/workflows/terminal-stylist.lock.yml @@ -481,6 +481,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/test-quality-sentinel.lock.yml b/.github/workflows/test-quality-sentinel.lock.yml index 0ce42809613..945ae24e0fa 100644 --- a/.github/workflows/test-quality-sentinel.lock.yml +++ b/.github/workflows/test-quality-sentinel.lock.yml @@ -1,5 +1,5 @@ # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"74eeb48d2038a4e7ce9550248b27283d32f276fcf116bf4cfaf3d43e89419838","body_hash":"31ab401e5b7ee4f5eb709116a6c78289f7e52bcd112a17e03ebaff87d069883a","strict":true,"agent_id":"copilot","agent_model":"${{ needs.activation.outputs.model_size }}","engine_versions":{"copilot":"1.0.103"}} -# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} +# gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"9000827ccba6bdab643e8b6fd33ac0654aef8333","version":"v8.0.2"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"949feb2413d6458794dcd2491c4babbbce0c15c1","version":"v7.1.0"},{"repo":"actions/upload-artifact","sha":"cf430e030ddbb5b0abf93d22962f4752f3646cd9","version":"v7.0.2"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0","digest":"sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.29.0@sha256:b14bd399376180b5649a9324be3b50fbfc82bfe8f0c80045840416b5a4e65b96"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0","digest":"sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.29.0@sha256:baff00b856a4bdc93bce134928c70af3d3492f2e518757115042040674d56b0b"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0","digest":"sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.29.0@sha256:087a8e4efff8ac62d46e106cd22005c002822b1481fc233097799511be353b5d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0","digest":"sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.29.0@sha256:6e0cbf7f980beb78b5461563a8164f6439ca959bc93733d5a6b52972e523ed50"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.5.0","digest":"sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.5.0@sha256:d3544a4222e7efeeeb38669d8a1af0c72691c55b8f6506b15aa5920f7f31b7bc"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f","pinned_image":"ghcr.io/github/gh-aw-node@sha256:2c2ea524e648b91c8333ce246e3838fcf5b19ac70e45baac1a51b9207299749f"},{"image":"ghcr.io/github/github-mcp-server:v2.0.3","digest":"sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132","pinned_image":"ghcr.io/github/github-mcp-server:v2.0.3@sha256:250bc6ce70788207608ef74cef4397230ff2e8481218da74d6093e4bd9101132"}],"has_pull_request":true,"mcp_servers":[{"name":"safeoutputs","tools":["add_comment","noop","report_incomplete","report_missing_data","report_missing_tool","submit_pull_request_review"]}],"threat_detection":{"mode":"enabled"},"admission":true} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # # ___ _ _ @@ -40,6 +40,7 @@ # - GITHUB_TOKEN # # Custom actions used: +# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # - actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -717,12 +718,21 @@ jobs: # Cache configuration from frontmatter processed below - name: Cache (pr-test-prefetch-${{ github.event.pull_request.head.sha || github.event.issue.number }}) + if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request' }} uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: pr-test-prefetch-${{ github.event.pull_request.head.sha || github.event.issue.number }} path: /tmp/gh-aw/agent restore-keys: | pr-test-prefetch-${{ github.event.pull_request.number || github.event.issue.number }}- + - name: Cache (pr-test-prefetch-${{ github.event.pull_request.head.sha || github.event.issue.number }}) + if: ${{ (!(github.event_name == 'push')) && (!(github.event_name == 'workflow_dispatch')) && (!(github.event_name == 'repository_dispatch')) && (!(github.event_name == 'delete')) && (!(github.event_name == 'registry_package')) && (!(github.event_name == 'page_build')) && (!(github.event_name == 'schedule')) && (!(github.event_name == 'pull_request')) }} + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + key: pr-test-prefetch-${{ github.event.pull_request.head.sha || github.event.issue.number }} + path: /tmp/gh-aw/agent + restore-keys: | + pr-test-prefetch-${{ github.event.pull_request.number || github.event.issue.number }}- - name: Configure Git credentials env: GITHUB_REPOSITORY: ${{ github.repository }} diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index 02795dc907c..e596378d12d 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -570,6 +570,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml index 127b6ca370d..f8a3b71b6fa 100644 --- a/.github/workflows/typist.lock.yml +++ b/.github/workflows/typist.lock.yml @@ -536,6 +536,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-claude-${{ github.workflow }}" queue: max diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml index cc5ccf0a172..85ac4a0969e 100644 --- a/.github/workflows/ubuntu-image-analyzer.lock.yml +++ b/.github/workflows/ubuntu-image-analyzer.lock.yml @@ -523,6 +523,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/uk-ai-operational-resilience.lock.yml b/.github/workflows/uk-ai-operational-resilience.lock.yml index e82c56c2daa..53e0b860274 100644 --- a/.github/workflows/uk-ai-operational-resilience.lock.yml +++ b/.github/workflows/uk-ai-operational-resilience.lock.yml @@ -495,6 +495,7 @@ jobs: issues: read pull-requests: read security-events: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 0844ab2067f..5712d621d4e 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -582,6 +582,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2969,12 +2970,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: unbloatdocs diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml index 056311b406f..174fd204b8c 100644 --- a/.github/workflows/update-astro.lock.yml +++ b/.github/workflows/update-astro.lock.yml @@ -535,6 +535,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml index d3a3dd3bed6..8085ada4adb 100644 --- a/.github/workflows/video-analyzer.lock.yml +++ b/.github/workflows/video-analyzer.lock.yml @@ -480,6 +480,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml index 2088b140bd8..1494d863653 100644 --- a/.github/workflows/visual-regression-checker.lock.yml +++ b/.github/workflows/visual-regression-checker.lock.yml @@ -511,6 +511,7 @@ jobs: permissions: contents: read pull-requests: read + cache-mode: read timeout-minutes: 15 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml index 2371894dfb8..1e03a0d316b 100644 --- a/.github/workflows/weekly-blog-post-writer.lock.yml +++ b/.github/workflows/weekly-blog-post-writer.lock.yml @@ -576,6 +576,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index 8f3d19503d8..dfd49e92cec 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -509,6 +509,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml index da36aecba55..b8f34fa12e0 100644 --- a/.github/workflows/weekly-issue-summary.lock.yml +++ b/.github/workflows/weekly-issue-summary.lock.yml @@ -493,6 +493,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2285,12 +2286,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: weeklyissuesummary diff --git a/.github/workflows/weekly-network-domains-audit.lock.yml b/.github/workflows/weekly-network-domains-audit.lock.yml index 17b2ebd1b79..c72e5385374 100644 --- a/.github/workflows/weekly-network-domains-audit.lock.yml +++ b/.github/workflows/weekly-network-domains-audit.lock.yml @@ -473,6 +473,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max @@ -2230,12 +2231,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: weeklynetworkdomainsaudit diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml index 3a16cedcd62..6ac92f7345c 100644 --- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml +++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml @@ -500,6 +500,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-pi-${{ github.workflow }}" queue: max diff --git a/.github/workflows/windows-grower.lock.yml b/.github/workflows/windows-grower.lock.yml index 0a958f8fefd..cde7fdf5e1e 100644 --- a/.github/workflows/windows-grower.lock.yml +++ b/.github/workflows/windows-grower.lock.yml @@ -499,6 +499,7 @@ jobs: contents: read copilot-requests: write issues: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2351,12 +2352,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: windowsgrower diff --git a/.github/workflows/windows.lock.yml b/.github/workflows/windows.lock.yml index d642f83a621..f4c76fcf7ec 100644 --- a/.github/workflows/windows.lock.yml +++ b/.github/workflows/windows.lock.yml @@ -596,6 +596,7 @@ jobs: permissions: contents: read copilot-requests: write + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml index 22652310acd..287570ad290 100644 --- a/.github/workflows/workflow-generator.lock.yml +++ b/.github/workflows/workflow-generator.lock.yml @@ -534,6 +534,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index 6c8d381ae52..94d87103581 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -495,6 +495,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml index 8a4f5e9e5c4..7abe369671d 100644 --- a/.github/workflows/workflow-normalizer.lock.yml +++ b/.github/workflows/workflow-normalizer.lock.yml @@ -497,6 +497,7 @@ jobs: copilot-requests: write issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-codex-${{ github.workflow }}" queue: max @@ -2359,12 +2360,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: workflownormalizer diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml index 848ccf8219b..147b3592b54 100644 --- a/.github/workflows/workflow-skill-extractor.lock.yml +++ b/.github/workflows/workflow-skill-extractor.lock.yml @@ -480,6 +480,7 @@ jobs: contents: read issues: read pull-requests: read + cache-mode: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" queue: max diff --git a/docs/adr/72543-detection-gated-cache-access-via-job-level-cache-mode.md b/docs/adr/72543-detection-gated-cache-access-via-job-level-cache-mode.md new file mode 100644 index 00000000000..2559fc8bb22 --- /dev/null +++ b/docs/adr/72543-detection-gated-cache-access-via-job-level-cache-mode.md @@ -0,0 +1,38 @@ +# ADR-72543: Detection-gated cache access via job-level `cache-mode` + +## Status + +Proposed in [PR #72543](https://github.com/github/gh-aw/pull/72543). +Adoption is pending repository maintainer review; no decider identities or human approval are asserted by this record. + +## Context + +An agent executes before threat detection can judge its output. Selecting a restore-only cache action does not restrict the job's scoped cache token: agent-executed code can still call the cache service directly. Preventing publication before detection therefore requires a platform-enforced token boundary, not just a different cache action. + +Cache-memory publication must remain possible after detection explicitly accepts the run. Detection in warning mode can succeed as a job while rejecting persistence, so job success alone is not an acceptance signal. Acceptance also does not establish artifact authenticity or turn low-trust inputs into trusted cache content. + +GitHub.com supports workflow- and job-level `cache-mode` token policies. GHES compatibility mode cannot assume that support. Trusted workflows also use dependency caches, whose existing save behavior should not be lost merely because threat detection is enabled. + +## Decision + +Use job-level `cache-mode` on GitHub.com to limit agent cache access while detection is pending, except where trusted dependency-cache saves require the platform's trigger-scoped default token. Without nonempty dependency-cache entries, including `cache: []`, the detection-enabled agent uses `cache-mode: read`. With dependency caches, low-trust events use restore-only actions and inherit the platform's read-only default; trusted events retain combined restore/save actions and the platform's default write access. Runtime event conditions preserve that distinction in mixed-trigger workflows because `cache-mode` accepts literal values, not event-dependent expressions. + +A separate cache-memory publisher uses `cache-mode: write-only` and requires both successful prerequisite jobs and explicit detection acceptance (`needs.detection.outputs.detection_success == 'true'`). Missing acceptance, rejected output, or runtime-skipped detection must not authorize publication. Both publisher and dependency-save actions use a fail-closed event allowlist: `push`, `workflow_dispatch`, `repository_dispatch`, `delete`, `registry_package`, `page_build`, `schedule`, and merge-ref-isolated `pull_request`. All other events are restore-only, including issue/discussion events and unknown future events. Reusable workflows use the original caller's runtime event; `workflow_call` by itself grants nothing. Detection acceptance, including the detector's no-output short-circuit, does not justify overriding the platform's low-trust defaults or writing cache lineages restored by higher-trust runs. + +GHES compatibility mode omits compiler-generated `cache-mode` fields. The Actions AST preserves authored job-level policies, and the `cache-poisoning` linter warns about explicit `write` or `write-only` overrides on known events outside the write allowlist, including inherited workflow and reusable-caller policies. The actionlint compatibility filter ignores only unsupported-key diagnostics at the supported workflow and job locations, not misplaced keys or malformed values. + +### Alternatives considered + +- **Restore-only actions alone:** Compatible with GHES and simpler, but insufficient because they do not restrict direct cache writes using the job token. +- **Workflow-level read-only cap:** Restricts the agent, but also prevents the separate publisher from writing accepted memory and disables trusted dependency-cache saves. Job-level policies and trigger-scoped defaults preserve those responsibilities. +- **Publisher gated only on detection job success:** Insufficient in warning mode, where a successful job can still reject persistence. An explicit acceptance output is required. + +## Consequences + +The GitHub.com agent token cannot write caches while the detection gate is active unless allowed dependency-cache compatibility requires the platform default. Publication requires an explicit acceptance signal and an event from the write allowlist. On eligible runs the separate publisher can write without receiving cache-read access. + +Trusted dependency-cache saves are intentionally not detection-gated. A trusted agent with those caches retains direct token write capability before detection runs; restore-only actions would not remove that capability. This is a compatibility tradeoff, not a claim that detection attests cached dependencies. + +GHES does not receive scoped-token enforcement from these generated fields. Restore-only actions there are not an equivalent security boundary. Authored custom jobs, third-party cache writers, dependency-cache namespaces, and persistent runner caches require their own review; detection acceptance is not attestation. + +Compiler job policies, detection conditions, cache actions, AST validation, lint compatibility, and generated locks must remain consistent. Trusted dependency-cache save behavior must be covered by regression tests. Workflows without detection retain their existing same-job cache-memory behavior. Dry-run compilation omits the publisher and uses restore-only compiler-managed actions, with scoped-token read restrictions only outside GHES compatibility mode. diff --git a/docs/src/content/docs/experimental/drive-memory.md b/docs/src/content/docs/experimental/drive-memory.md index 4a8394e7ee2..f17f81043e9 100644 --- a/docs/src/content/docs/experimental/drive-memory.md +++ b/docs/src/content/docs/experimental/drive-memory.md @@ -16,10 +16,14 @@ Drive memory is an experimental, feature-gated integration backed by the [GitHub For enrolled preview repositories, the compiler mounts configured drives into the agent at `/tmp/gh-aw/drive-memory/` (or `/tmp/gh-aw/drive-memory-{id}/` for named entries). It grants the generated job `contents: read`, `id-token: write`, and the required `drives` permission. -The compiler checks out each drive before the agent and commits validated changes afterward. With threat detection enabled, it stages drive contents as an artifact; a separate `update_drive_memory` job publishes it only after detection succeeds and verifies the drive has not changed since checkout. +The compiler checks out each drive before the agent and commits validated changes afterward. With threat detection enabled, it stages drive contents as an artifact; a separate `update_drive_memory` job publishes it only after the agent succeeds and detection explicitly accepts the output, and verifies the drive has not changed since checkout. Failed, skipped, missing, or rejected detection blocks publication, including rejection in warning mode. Drive names are repository-wide and branch-aware according to the preview service. GitHub Drives allows one active writer for a drive, so overlapping runs that write the same drive can contend for the writer lease. +Drive publication intentionally supports admitted issue and slash-command runs; it does not use the Actions cache service's event allowlist or `cache-mode` policy. The pinned preview action requests storage using the repository, `GITHUB_REF`, and drive name. Runs sharing that scope can exchange persisted content across event types. Detection acceptance and configured validation do not authenticate the content or guarantee safe interpretation by a later agent; the detector's no-output short-circuit is not a scan of every drive file. Do not share a drive scope across contexts that require stronger producer isolation. + +`restore-only: true` and dry-run prevent compiler-managed drive publication, not local file edits or arbitrary script effects. Without threat detection, writable drives retain same-job publication without a detection gate. The compiler does not verify the preview service's server-side namespace enforcement. + ## Validation Drive-memory supports the same `validation.json-schemas` declarations as repo-memory and cache-memory. Each declaration has an inline `schema` and may specify a relative file path or glob (with `*` within a path segment and `**` across segments). If `file` is omitted, the schema applies to every eligible `.json` and `.jsonl` file in the memory directory, excluding `.git`; omit `format` too so the format is inferred for each file. Otherwise, each path must exist, each glob must match at least one file, and every matched file must pass validation before the drive accepts or persists the candidate. The format is inferred from each matched file's `.json` or `.jsonl` extension (case-insensitive). Optional `format: json` or `format: jsonl` overrides inference and is required for other extensions. diff --git a/docs/src/content/docs/reference/cache-memory.md b/docs/src/content/docs/reference/cache-memory.md index b5fbb77c621..1f581a9701b 100644 --- a/docs/src/content/docs/reference/cache-memory.md +++ b/docs/src/content/docs/reference/cache-memory.md @@ -158,7 +158,7 @@ The compiler generates git-backed branching steps around the agent. Before the a | `unapproved` | `unapproved` + `approved` + `merged` | `none` | | `none` | all levels | — | -This prevents a lower-integrity agent from poisoning data that a higher-integrity run would later read. +These compiler-generated namespaces separate lower- and higher-integrity cache-memory lineages. They do not authenticate cache contents or protect against another cache writer deliberately using the same namespace. > [!NOTE] > Existing caches will get a cache miss on first run after upgrading to a version that includes this feature — intentional, as legacy data has no integrity provenance. @@ -167,6 +167,24 @@ This prevents a lower-integrity agent from poisoning data that a higher-integrit Do not store sensitive data in cache memory. It follows repository permissions, and with [threat detection](/gh-aw/reference/threat-detection/) enabled, caches save only after validation succeeds (`restore → modify → upload artifact → validate → save`). +### Cache access boundaries + +On GitHub.com, detection-enabled workflows without nonempty frontmatter dependency-cache entries give the agent job `cache-mode: read`. An empty list (`cache: []`) does not enable dependency-cache saves or remove this restriction. This restricts its scoped cache token; selecting a restore-only action alone would not restrict other writers. + +Workflows with frontmatter `cache:` entries instead retain the platform's trigger-scoped token defaults so dependency caches can still be populated. Runtime event conditions allow combined restore/save actions only for `push`, `workflow_dispatch`, `repository_dispatch`, `delete`, `registry_package`, `page_build`, `schedule`, and merge-ref-isolated `pull_request` runs. Every other event, including `issues`, `discussion`, `discussion_comment`, and unknown future events, selects restore-only actions. This also applies to mixed-trigger and reusable workflows: the original caller's runtime event controls access. Allowed dependency-cache saves are not detection-gated, and agents on those events retain direct token write capability before detection. + +Writable cache-memory entries are published by the separate `update_cache_memory` job with `cache-mode: write-only`. The job requires an event from the same write allowlist, successful agent and detection jobs, and `needs.detection.outputs.detection_success == 'true'`, then applies configured memory validation before saving. All other events remain blocked even after detector acceptance, so issue/discussion-driven runs cannot publish into the lineage trusted runs restore. Detection warnings, rejected verdicts, missing acceptance outputs, failed jobs, and a detection job skipped by its runtime condition block persistence even when `continue-on-error` permits other safe outputs. The detector's internal no-output short-circuit still reports acceptance; it is not evidence that every cached file was scanned. + +The publisher's explicit write capability is restricted to eligible events by its job condition; detector acceptance alone cannot authorize low-trust publication. Neither this capability nor a detector verdict authenticates the uploaded artifact or cached content. Treat memory as data, not executable code. + +Dry-run compilation uses restore-only compiler-managed cache actions and omits the cache-memory publisher. Outside GHES compatibility mode, it also sets workflow-level and agent-job `cache-mode: read`. `restore-only: true` entries are never published. + +For servers that do not support `cache-mode`, enable [GHES compatibility mode](/gh-aw/reference/enterprise-configuration/#ghes-compatibility-mode) with `gh aw compile --ghes my-workflow.md` or `"ghes": true` in `.github/workflows/aw.json`, then recompile. This omits compiler-generated `cache-mode` fields even during dry-run and also changes artifact-action pins. GitHub's announcement confirms GitHub.com availability, not a GHES release. Cache-memory restore-only agent actions, publisher event/validation gates, and event-conditioned dependency-cache actions remain. Without scoped-token enforcement, arbitrary cache writers are not constrained by this compiler boundary. + +Without detection, existing same-job cache-memory behavior is unchanged: cache saves depend on the platform's trigger-based defaults. GitHub.com defaults events outside its default-branch write allowlist to read-only; `pull_request` caches are isolated to the merge ref. Custom jobs have their own cache-access boundary. The [`cache-poisoning` linter](/gh-aw/reference/workflow-linters/) warns about effective explicit write overrides for known events outside the allowlist and for reusable workflows whose caller policy needs review; it does not prove a dedicated publisher safe or validate arbitrary shell cache operations. + +Cache contents are unsigned and unverified. Cache-memory key isolation does not cover ordinary dependency-cache keys, third-party cache writers, or persistent caches on reused runners. See GitHub's [cache access reference](https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#controlling-cache-access-with-cache-mode). + ## Examples See [Grumpy Code Reviewer](https://github.com/github/gh-aw/blob/main/.github/workflows/grumpy-reviewer.md) for tracking PR review history. diff --git a/docs/src/content/docs/reference/compilation-process.md b/docs/src/content/docs/reference/compilation-process.md index 590b4215ce6..d43d9737c9d 100644 --- a/docs/src/content/docs/reference/compilation-process.md +++ b/docs/src/content/docs/reference/compilation-process.md @@ -329,8 +329,8 @@ unrecognized versions fall back to Docker. Local actionlint uses shellcheck and pyflakes from `PATH` when those integrations are enabled; it does not install them. Compilation and `gh aw lint` ignore actionlint's unsupported-key diagnostic for -workflow-level `cache-mode`. Other syntax and security diagnostics, including -misplaced `cache-mode` keys, are unaffected. +workflow- and job-level `cache-mode`. Other syntax and security diagnostics, +including step-level keys, misspelled keys, and malformed values, are unaffected. ### Development Testing Mode diff --git a/docs/src/content/docs/reference/enterprise-configuration.md b/docs/src/content/docs/reference/enterprise-configuration.md index 547bfb80e5c..e773d094652 100644 --- a/docs/src/content/docs/reference/enterprise-configuration.md +++ b/docs/src/content/docs/reference/enterprise-configuration.md @@ -20,6 +20,11 @@ GHES instances running versions that predate `@actions/artifact` v2.0.0 support gh-aw includes a GHES compatibility mode toggle (`aw.json` `ghes` or `gh aw compile --ghes`) for GHES releases that require the v3 artifact backend. Compatibility mode emits `upload-artifact@v3.2.2` and `download-artifact@v3.1.0`; default GitHub.com compilation continues to use the latest artifact actions. +Compatibility mode also omits compiler-generated workflow and job `cache-mode` fields, including dry-run fields. The [GitHub announcement](https://github.blog/changelog/2026-09-10-control-github-actions-cache-access-with-cache-mode/) establishes availability on GitHub.com, not a supported GHES release. Enable compatibility mode when the target server does not support this syntax, then recompile the workflows. This is the existing combined GHES switch, not an independent cache-only option or automatic server-version negotiation. + +> [!WARNING] +> Omitting `cache-mode` removes the scoped-token cache restriction. Detection-enabled cache-memory restores, publisher event/validation gates, and event-conditioned dependency-cache actions remain. Dry-run still uses restore-only compiler-managed cache actions and omits the cache-memory publisher; it cannot constrain arbitrary cache writers through the scoped token on unsupported servers. See [cache access boundaries](/gh-aw/reference/cache-memory/#cache-access-boundaries). + This compatibility path supports GHES 3.21.x and earlier when the workflow runs on Actions Runner 2.327.1 or later, which is required by the Node.js 24 runtime used by these pinned artifact actions. For later GHES releases, keep compatibility mode enabled until your instance supports the v4 artifact backend. #### Enable via `aw.json` (recommended) diff --git a/docs/src/content/docs/reference/workflow-linters.md b/docs/src/content/docs/reference/workflow-linters.md index b526f9f82d0..d0557bfe02e 100644 --- a/docs/src/content/docs/reference/workflow-linters.md +++ b/docs/src/content/docs/reference/workflow-linters.md @@ -42,7 +42,7 @@ The compiler threat IDs reference the [Compiler Threat Detection Specification]( | `grader-file-io` | — | AW | Custom `graders..script` JavaScript ASTs do not access filesystem/host capabilities or load modules. Requires the optional native JavaScript parser; missing parser configuration produces a visible coverage warning. | | `grader-shell-file-write` | — | AW | Repository-owned `graders.operational-value.run` Bash ASTs avoid detected file writes and unchecked shell execution. Loads confined evaluator source without executing it; no optional JavaScript parser required. | | `artipacked` | — | AW, Actions | `actions/checkout` explicitly disables credential persistence. Omitted, enabled, or dynamic persistence produces a review warning; later authenticated Git operations may require it. During compilation only, exact compiler-generated blocks can exempt PR checkouts in `safe_outputs` whose trusted handlers require retained credentials, or agent checkouts immediately followed by compiler-owned credential cleanup and verification when their paths are statically within discovery coverage (at most 13 directory components beneath the workspace). Deeper or unknown paths retain warnings. Authored steps and standalone `gh aw lint` checks remain unchanged. | -| `cache-poisoning` | — | AW, Actions | Release-event and tag-push workflows avoid cache restoration through `actions/cache`, `actions/cache/restore`, `actions/setup-go`, and `actions/setup-node`. Save-only and lookup-only actions are exempt. | +| `cache-poisoning` | — | AW, Actions | Authored workflow- and job-level `cache-mode` values must be literal `read`, `write`, `write-only`, or `none`, regardless of trigger or cache-action presence; omit the key for defaults, rather than specifying an empty or null value. Release-event and tag-push workflows avoid cache restoration through `actions/cache`, `actions/cache/restore`, `actions/setup-go`, and `actions/setup-node`; save-only and lookup-only actions are exempt from the restore check. Explicit effective `cache-mode: write` or `write-only` on known events outside GitHub's write allowlist, including issue/discussion events, warns about overriding the read-only default. Reusable workflows require caller-policy review. A job-level `read` or `none` overrides an inherited workflow write mode. Job names do not establish publisher trust. | | `excessive-permissions` | `CTR-001` | Actions | Workflow-wide write grants are moved to the jobs that require them. Job-level writes and AW root grants are not workflow-wide permissions. | | `obfuscation` | — | AW, Actions | Runner-interpolated fields avoid literal-only string expressions such as `${{ '' }}`. Ordinary expressions, fallback strings, and boolean conditions are unaffected. | | `bash-case-pattern` | — | AW, Actions | Bash `case` patterns inside `$(...)` use balanced `(pattern)` syntax for Bash 3.2 compatibility. Intentional variable glob matching remains unquoted. Reports warnings without executing scripts or requiring ShellCheck. | diff --git a/pkg/cli/lint_cache_mode_test.go b/pkg/cli/lint_cache_mode_test.go new file mode 100644 index 00000000000..0a829b2ade0 --- /dev/null +++ b/pkg/cli/lint_cache_mode_test.go @@ -0,0 +1,125 @@ +//go:build !integration + +package cli + +import ( + "bytes" + "encoding/json" + "os" + "path/filepath" + "testing" + + workflowlint "github.com/github/gh-aw/pkg/workflow/lint" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestCacheWriteOverrideCLI(t *testing.T) { + for _, test := range []struct { + name, trigger, root, job, want string + }{ + {"low trust job", "issue_comment", "", "write-only", "jobs.check.cache-mode"}, + {"issues job", "issues", "", "write-only", "jobs.check.cache-mode"}, + {"discussion job", "discussion", "", "write", "jobs.check.cache-mode"}, + {"discussion comment job", "discussion_comment", "", "write-only", "jobs.check.cache-mode"}, + {"mixed issues caller", "{push: {}, issues: {}}", "write", "", "cache-mode"}, + {"inherited workflow", "workflow_run", "write", "", "cache-mode"}, + {"reusable caller grants no writes", "workflow_call", "", "write-only", "jobs.check.cache-mode"}, + {"reusable caller default", "workflow_call", "", "", ""}, + {"reusable caller read", "workflow_call", "", "read", ""}, + {"capped job", "pull_request_target", "write", "read", ""}, + {"dispatch default", "repository_dispatch", "", "write", ""}, + } { + t.Run(test.name, func(t *testing.T) { + source := "on: " + test.trigger + "\n" + if test.root != "" { + source += "cache-mode: " + test.root + "\n" + } + source += "jobs:\n check:\n runs-on: ubuntu-latest\n steps: [{run: echo data}]\n" + if test.job != "" { + source += " cache-mode: " + test.job + "\n" + } + file := filepath.Join(t.TempDir(), "cache.yml") + require.NoError(t, os.WriteFile(file, []byte(source), 0600)) + cmd := NewLintCommand() + var output bytes.Buffer + cmd.SetOut(&output) + cmd.SetErr(&output) + cmd.SetArgs([]string{"--rules=cache-poisoning", "--json", file}) + require.NoError(t, cmd.Execute()) + var diagnostics []workflowLintDiagnostic + require.NoError(t, json.NewDecoder(&output).Decode(&diagnostics)) + if test.want == "" { + assert.Empty(t, diagnostics) + } else { + require.Len(t, diagnostics, 1) + assert.Equal(t, "cache-poisoning", diagnostics[0].RuleID) + assert.Equal(t, workflowlint.Warning, diagnostics[0].Severity) + assert.Equal(t, test.want, diagnostics[0].Path) + } + }) + } +} + +func TestLintCacheModeLiteralsCLI(t *testing.T) { + for _, scope := range []string{"workflow", "job"} { + for _, test := range []struct { + name, mode string + valid bool + }{ + {"absent", "", true}, + {"read", "read", true}, + {"write", "write", true}, + {"write only", "write-only", true}, + {"none", "none", true}, + {"unsupported", "read-only", false}, + {"empty string", `""`, false}, + {"empty scalar", "\n", false}, + {"null", "null", false}, + {"number", "42", false}, + {"boolean", "true", false}, + {"sequence", "[read]", false}, + {"mapping", "{mode: read}", false}, + {"expression", `"${{ 'read' }}"`, false}, + {"leading whitespace", `" read"`, false}, + {"trailing whitespace", `"read "`, false}, + {"uppercase", "READ", false}, + } { + t.Run(scope+"/"+test.name, func(t *testing.T) { + source := "on: push\npermissions: {contents: read}\n" + if scope == "workflow" && test.mode != "" { + source += "cache-mode: " + test.mode + "\n" + } + source += "jobs:\n check:\n runs-on: ubuntu-latest\n" + if scope == "job" && test.mode != "" { + source += " cache-mode: " + test.mode + "\n" + } + source += " steps: [{run: echo data}]\n" + file := filepath.Join(t.TempDir(), "cache.yml") + require.NoError(t, os.WriteFile(file, []byte(source), 0600)) + for _, args := range [][]string{{file}, {"--rules=cache-poisoning", file}} { + cmd := NewLintCommand() + var output bytes.Buffer + cmd.SetOut(&output) + cmd.SetErr(&output) + cmd.SetArgs(args) + err := cmd.Execute() + if test.valid { + require.NoError(t, err, output.String()) + } else { + require.Error(t, err, output.String()) + if test.mode == "read-only" || test.mode == `""` { + path := "cache-mode" + if scope == "job" { + path = "jobs.check.cache-mode" + } + require.ErrorContains(t, err, "cache-poisoning") + require.ErrorContains(t, err, path) + require.ErrorContains(t, err, "requires read, write, write-only, or none") + } + } + } + }) + } + } +} diff --git a/pkg/cli/lint_command.go b/pkg/cli/lint_command.go index 6ae5231cb81..d17ffd13ee5 100644 --- a/pkg/cli/lint_command.go +++ b/pkg/cli/lint_command.go @@ -29,8 +29,9 @@ var defaultGhAwActionlintIgnorePatterns = []string{ `property "workflow_(repository|sha|ref|file_path)" is not defined in object type`, // GitHub is rolling out queue under concurrency before actionlint support. `unexpected key "queue" for "concurrency" section`, - // Dry-run workflows use GitHub's workflow-level cache policy before actionlint support. + // Generated workflows use GitHub's workflow/job cache policies before actionlint support. `^unexpected key "cache-mode" for "workflow" section(\.|$)`, + `^unexpected key "cache-mode" for "job" section(\.|$)`, // gh-aw injects additional activation context properties in generated workflows. `property "(activation|activated)" is not defined in object type`, // gh-aw injects additional artifact context properties in generated workflows. diff --git a/pkg/cli/lint_command_test.go b/pkg/cli/lint_command_test.go index a72497b55cd..87bc2ddd0f6 100644 --- a/pkg/cli/lint_command_test.go +++ b/pkg/cli/lint_command_test.go @@ -112,16 +112,34 @@ func TestActionlintCacheModeCompatibility(t *testing.T) { }, { name: "job cache policy", + message: `unexpected key "cache-mode" for "job" section. expected one of "concurrency", "container", "defaults", "env", "environment"`, + ignored: true, + }, + { + name: "job cache policy without expected keys", message: `unexpected key "cache-mode" for "job" section`, + ignored: true, }, { name: "step cache policy", message: `unexpected key "cache-mode" for "step" section`, }, + { + name: "run step cache policy", + message: `unexpected key "cache-mode" for step to run shell command. expected one of "continue-on-error", "env", "id", "if", "name", "run", "shell", "timeout-minutes", "working-directory"`, + }, { name: "misspelled workflow key", message: `unexpected key "cache-modes" for "workflow" section`, }, + { + name: "misspelled job key", + message: `unexpected key "cache-modes" for "job" section`, + }, + { + name: "invalid job section suffix", + message: `unexpected key "cache-mode" for "job" sectional`, + }, { name: "other workflow key", message: `unexpected key "unknown-key" for "workflow" section`, @@ -134,6 +152,10 @@ func TestActionlintCacheModeCompatibility(t *testing.T) { name: "other diagnostic mentioning the key", message: `invalid expression: unexpected key "cache-mode" for "workflow" section`, }, + { + name: "other diagnostic mentioning the job key", + message: `invalid expression: unexpected key "cache-mode" for "job" section`, + }, } { t.Run(tt.name, func(t *testing.T) { ignored := false diff --git a/pkg/workflow/actions/lower.go b/pkg/workflow/actions/lower.go index ba359665e3e..063aebd97dd 100644 --- a/pkg/workflow/actions/lower.go +++ b/pkg/workflow/actions/lower.go @@ -124,6 +124,7 @@ func nativeJobFields(job *Job) (map[string]any, error) { fields := make(map[string]any) for key, value := range map[string]any{ "permissions": job.Permissions, "defaults": optionalMap(job.Defaults), + "cache-mode": optionalString(job.CacheMode), "concurrency": job.Concurrency, "environment": job.Environment, "strategy": optionalMap(job.Strategy), "container": job.Container, "services": optionalMap(job.Services), "uses": optionalString(job.Uses), diff --git a/pkg/workflow/actions/parse.go b/pkg/workflow/actions/parse.go index b87e126b57d..2b9dc3aaa5d 100644 --- a/pkg/workflow/actions/parse.go +++ b/pkg/workflow/actions/parse.go @@ -33,6 +33,7 @@ type jobYAML struct { Steps []map[string]any `yaml:"steps"` Outputs map[string]any `yaml:"outputs"` Permissions any `yaml:"permissions"` + CacheMode string `yaml:"cache-mode"` Defaults map[string]any `yaml:"defaults"` Concurrency any `yaml:"concurrency"` Environment any `yaml:"environment"` @@ -91,12 +92,32 @@ func Parse(content []byte) (*Workflow, error) { return nil, fmt.Errorf("validating job %q: %w", job.ID, err) } } + if err := retainCacheModePresence(resolved, content); err != nil { + return nil, err + } if err := retainWorkflowSource(resolved, content); err != nil { return nil, err } return resolved, nil } +func retainCacheModePresence(workflow *Workflow, content []byte) error { + // String decoding alone conflates absent, empty, and null policies. + var fields map[string]any + if err := yaml.Unmarshal(content, &fields); err != nil { + return fmt.Errorf("parsing cache-mode presence: %w", err) + } + _, workflow.CacheModeSet = fields["cache-mode"] + if jobs, ok := fields["jobs"].(map[string]any); ok { + for _, job := range workflow.Jobs { + if fields, ok := jobs[string(job.ID)].(map[string]any); ok { + _, job.CacheModeSet = fields["cache-mode"] + } + } + } + return nil +} + func parseJob(id JobID, source *jobYAML) (*Job, error) { if source == nil { return nil, errors.New("job cannot be null") @@ -104,6 +125,7 @@ func parseJob(id JobID, source *jobYAML) (*Job, error) { job := &Job{ ID: id, Name: source.Name, RunsOn: source.RunsOn, Permissions: source.Permissions, Defaults: source.Defaults, + CacheMode: source.CacheMode, Concurrency: source.Concurrency, Environment: source.Environment, Strategy: source.Strategy, Container: source.Container, Services: source.Services, Uses: source.Uses, diff --git a/pkg/workflow/actions/parse_test.go b/pkg/workflow/actions/parse_test.go index da652591861..93a43bfd5a8 100644 --- a/pkg/workflow/actions/parse_test.go +++ b/pkg/workflow/actions/parse_test.go @@ -3,6 +3,7 @@ package actions import ( "testing" + "github.com/goccy/go-yaml" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -93,6 +94,117 @@ func TestParseRejectsInvalidNativeYAML(t *testing.T) { } } +func TestParseJobCacheModes(t *testing.T) { + for _, mode := range []string{"read", "write", "write-only", "none"} { + t.Run(mode, func(t *testing.T) { + source := "cache-mode: read\non: issue_comment\njobs:\n runner:\n runs-on: ubuntu-latest\n cache-mode: " + + mode + "\n steps: [{run: echo data}]\n call:\n uses: ./.github/workflows/worker.yml\n cache-mode: " + mode + "\n" + input, err := Parse([]byte(source)) + require.NoError(t, err) + for _, job := range input.Jobs { + assert.Equal(t, mode, job.CacheMode) + } + fields, err := Lower(input) + require.NoError(t, err) + content, err := yaml.Marshal(fields) + require.NoError(t, err) + var lowered map[string]any + require.NoError(t, yaml.Unmarshal(content, &lowered)) + jobs := lowered["jobs"].(map[string]any) + for _, id := range []string{"runner", "call"} { + assert.Equal(t, mode, jobs[id].(map[string]any)["cache-mode"]) + } + input.Jobs[0].CacheMode = "none" + emitted, err := Emit(input) + require.NoError(t, err) + reparsed, err := Parse([]byte(emitted)) + require.NoError(t, err) + assert.Equal(t, input.Jobs, reparsed.Jobs) + assert.Equal(t, input.CacheMode, reparsed.CacheMode) + }) + } +} + +func TestParseCacheModePresence(t *testing.T) { + for _, test := range []struct { + name, policy string + present bool + }{ + {"absent", "", false}, + {"read", "cache-mode: read\n", true}, + {"empty string", "cache-mode: \"\"\n", true}, + {"empty scalar", "cache-mode:\n", true}, + {"null", "cache-mode: null\n", true}, + } { + t.Run(test.name, func(t *testing.T) { + source := test.policy + "jobs:\n check:\n runs-on: ubuntu-latest\n steps: [{run: echo data}]\n" + if test.policy != "" { + source += " " + test.policy + } + input, err := Parse([]byte(source)) + require.NoError(t, err) + assert.Equal(t, test.present, input.CacheModeSet) + assert.Equal(t, test.present, input.Jobs[0].CacheModeSet) + emitted, err := Emit(input) + require.NoError(t, err) + assert.Equal(t, source, emitted) + }) + } +} + +func TestParseCacheModePresenceThroughAliases(t *testing.T) { + source := `cache-mode: &policy null +jobs: + check: &job + runs-on: ubuntu-latest + cache-mode: *policy + steps: [{run: echo data}] + inherited: + <<: *job +` + input, err := Parse([]byte(source)) + require.NoError(t, err) + assert.True(t, input.CacheModeSet) + require.Len(t, input.Jobs, 2) + for _, job := range input.Jobs { + assert.True(t, job.CacheModeSet) + assert.Empty(t, job.CacheMode) + } +} + +func TestCacheModeEmissionPreservesScalarBoundary(t *testing.T) { + for _, mode := range []string{ + "read\n permissions:\n contents: write", + "read\r permissions: write-all", + "read\r\n steps:\n - run: echo injected", + " read\t ", + } { + t.Run(mode, func(t *testing.T) { + for _, authored := range []bool{false, true} { + input := &Workflow{Jobs: []*Job{{ + ID: "call", Uses: "./.github/workflows/worker.yml", + }}} + if authored { + var err error + input, err = Parse([]byte("jobs:\n call:\n uses: ./.github/workflows/worker.yml\n")) + require.NoError(t, err) + } + input.Jobs[0].CacheMode = mode + content, err := Emit(input) + require.NoError(t, err) + var parsed map[string]any + require.NoError(t, yaml.Unmarshal([]byte(content), &parsed)) + jobs := parsed["jobs"].(map[string]any) + require.Len(t, jobs, 1) + fields := jobs["call"].(map[string]any) + require.Len(t, fields, 2) + assert.Equal(t, mode, fields["cache-mode"]) + assert.Equal(t, "./.github/workflows/worker.yml", fields["uses"]) + } + }) + } +} + func TestParseMultilineAuthoredConditions(t *testing.T) { condition := "contains(github.event.comment.body, '/q\n') &&\n github.event_name == 'issue_comment'" source := "jobs:\n call:\n uses: ./.github/workflows/worker.yml\n if: " + diff --git a/pkg/workflow/actions/workflow.go b/pkg/workflow/actions/workflow.go index 2a9ffc96229..19c2fc138c4 100644 --- a/pkg/workflow/actions/workflow.go +++ b/pkg/workflow/actions/workflow.go @@ -4,15 +4,16 @@ import "errors" // Workflow contains only GitHub Actions workflow properties. type Workflow struct { - Name string - RunName string - On any - Permissions any - Env map[string]Expression - Defaults map[string]any - Concurrency any - CacheMode string - Jobs []*Job + Name string + RunName string + On any + Permissions any + Env map[string]Expression + Defaults map[string]any + Concurrency any + CacheMode string + CacheModeSet bool // Distinguishes an authored empty value from an absent cache policy. + Jobs []*Job source *workflowSource } @@ -28,6 +29,8 @@ type Job struct { Outputs map[OutputName]Expression Permissions any + CacheMode string + CacheModeSet bool Defaults map[string]any Concurrency any Environment any diff --git a/pkg/workflow/actions_ast.go b/pkg/workflow/actions_ast.go index 386dc44e919..f26fb726dfd 100644 --- a/pkg/workflow/actions_ast.go +++ b/pkg/workflow/actions_ast.go @@ -75,7 +75,7 @@ func jobToActions(original *Job) (*actions.Job, error) { name := original.Name job := &actions.Job{ ID: actions.JobID(name), Outputs: make(map[actions.OutputName]actions.Expression), - Uses: original.Uses, + Uses: original.Uses, CacheMode: original.CacheMode, } if original.RunsOn != "" { job.RunsOn = original.RunsOn @@ -161,6 +161,7 @@ func copyEnclosingJobSettings(job *actions.Job, original *Job, typed *actions.Jo func hasActionsExecutionSettings(job *actions.Job) bool { return job.Name != "" || job.RunsOn != nil || job.Permissions != nil || job.Defaults != nil || + job.CacheMode != "" || job.Concurrency != nil || job.Environment != nil || job.Strategy != nil || job.Container != nil || job.Services != nil || job.TimeoutMinutes != 0 || job.TimeoutMinutesExpression != nil || job.ContinueOnError != nil || job.Uses != "" || len(job.With) > 0 || len(job.Secrets) > 0 || job.SecretsInherit || len(job.CallOutputs) > 0 diff --git a/pkg/workflow/cache_access_test.go b/pkg/workflow/cache_access_test.go new file mode 100644 index 00000000000..1d7826d5035 --- /dev/null +++ b/pkg/workflow/cache_access_test.go @@ -0,0 +1,336 @@ +//go:build !integration + +package workflow + +import ( + "fmt" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/github/gh-aw/pkg/workflow/actions" + "github.com/github/gh-aw/pkg/workflow/cachepolicy" + "github.com/goccy/go-yaml" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestCompiledCacheAccessBoundaries(t *testing.T) { + for _, trigger := range []string{ + "pull_request_target", + "issue_comment", + "issues", + "discussion", + "discussion_comment", + "pull_request", + "workflow_call", + "{workflow_run: {workflows: [CI], branches: [main]}}", + "{push: {}, issue_comment: {}}", + "{push: {}, issues: {}}", + "{workflow_call: {}, discussion_comment: {}}", + "{repository_dispatch: {types: [refresh]}}", + "push", + "workflow_dispatch", + } { + for _, detection := range []string{"true", "false", `"${{ vars.DETECT == 'true' }}"`} { + t.Run(trigger+"/"+detection, func(t *testing.T) { + compiled, content := compileCacheAccessFixture(t, trigger, detection, false, false, false) + assert.NotContains(t, compiled, "cache-mode", "do not impose a workflow-wide cap on the publisher") + jobs := compiled["jobs"].(map[string]any) + agent := jobs["agent"].(map[string]any) + agentSteps := fmt.Sprint(agent["steps"]) + assert.NotContains(t, jobs["custom"].(map[string]any), "cache-mode", "authored jobs retain their own trust boundary") + if detection == "false" { + assert.NotContains(t, agent, "cache-mode", "preserve same-job cache-memory writes without detection") + assert.Contains(t, agentSteps, "actions/cache@") + assert.NotContains(t, jobs, "update_cache_memory") + return + } + assert.NotContains(t, agent, "cache-mode", "dependency caches inherit trigger-scoped access so trusted runs can save") + assert.Contains(t, agentSteps, "actions/cache@") + assert.NotContains(t, agentSteps, "actions/cache/save@") + assert.Contains(t, agentSteps, "actions/cache/restore@") + publisher := jobs["update_cache_memory"].(map[string]any) + assert.Equal(t, "write-only", publisher["cache-mode"]) + assert.Equal(t, map[string]any{"actions": "write", "contents": "read"}, publisher["permissions"]) + condition := strings.Join(strings.Fields(publisher["if"].(string)), " ") + assert.Equal(t, "always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request')", condition) + assert.ElementsMatch(t, []any{"activation", "agent", "detection"}, publisher["needs"]) + publisherSteps := fmt.Sprint(publisher["steps"]) + assert.Contains(t, publisherSteps, "actions/cache/save@") + assert.NotContains(t, publisherSteps, "actions/cache/restore@") + native, err := actions.Parse([]byte(content)) + require.NoError(t, err, "generated job cache modes must remain readable by native lint") + for _, job := range native.Jobs { + if string(job.ID) == "agent" { + assert.Empty(t, job.CacheMode) + } + } + assertDependencyCacheTrustGates(t, agent) + }) + } + } +} + +func TestCompiledCacheAccessDryRunAndGHES(t *testing.T) { + for _, ghes := range []bool{false, true} { + for _, dryRun := range []bool{false, true} { + for _, restoreOnly := range []bool{false, true} { + t.Run(fmt.Sprintf("ghes=%t/dry-run=%t/restore-only=%t", ghes, dryRun, restoreOnly), func(t *testing.T) { + compiled, content := compileCacheAccessFixture(t, "issue_comment", "true", ghes, dryRun, restoreOnly) + jobs := compiled["jobs"].(map[string]any) + agent := jobs["agent"].(map[string]any) + if ghes { + assert.NotContains(t, content, "cache-mode:") + } else if dryRun { + assert.Equal(t, "read", agent["cache-mode"]) + } else { + assert.NotContains(t, agent, "cache-mode") + } + if !dryRun { + assertDependencyCacheTrustGates(t, agent) + } + if dryRun || restoreOnly { + assert.NotContains(t, jobs, "update_cache_memory") + assert.NotContains(t, content, "actions/cache/save@") + } else { + publisher := jobs["update_cache_memory"].(map[string]any) + if ghes { + assert.NotContains(t, publisher, "cache-mode") + } else { + assert.Equal(t, "write-only", publisher["cache-mode"]) + } + } + if dryRun && !ghes { + assert.Equal(t, "read", compiled["cache-mode"]) + } else { + assert.NotContains(t, compiled, "cache-mode") + } + }) + } + } + } +} + +func TestCacheMemoryAgentRemainsReadOnlyWithoutDependencyCaches(t *testing.T) { + for _, event := range []string{"push", "issue_comment", "issues", "discussion_comment"} { + compiled, _ := compileCacheAccessFixture(t, event, "true", false, false, false, "") + agent := compiled["jobs"].(map[string]any)["agent"].(map[string]any) + assert.Equal(t, "read", agent["cache-mode"]) + } +} + +func TestCompiledCacheAccessEmptyDependencyArray(t *testing.T) { + for _, trigger := range []string{"push", "issue_comment", "{push: {}, issue_comment: {}}"} { + for _, detection := range []string{"true", "false", `"${{ vars.DETECT == 'true' }}"`} { + for _, ghes := range []bool{false, true} { + for _, dryRun := range []bool{false, true} { + t.Run(fmt.Sprintf("%s/detection=%s/ghes=%t/dry-run=%t", trigger, detection, ghes, dryRun), func(t *testing.T) { + compiled, content := compileCacheAccessFixture(t, trigger, detection, ghes, dryRun, false, "cache: []\n") + jobs := compiled["jobs"].(map[string]any) + agent := jobs["agent"].(map[string]any) + if !ghes && (dryRun || detection != "false") { + assert.Equal(t, "read", agent["cache-mode"]) + } else { + assert.NotContains(t, agent, "cache-mode") + } + agentSteps := fmt.Sprint(agent["steps"]) + assert.NotContains(t, agentSteps, "Cache (dependencies)") + if dryRun || detection != "false" { + assert.NotContains(t, agentSteps, "actions/cache@") + assert.NotContains(t, agentSteps, "actions/cache/save@") + assert.Contains(t, agentSteps, "actions/cache/restore@") + } else { + assert.Contains(t, agentSteps, "actions/cache@", "preserve same-job cache-memory writes without detection") + } + if dryRun || detection == "false" { + assert.NotContains(t, jobs, "update_cache_memory") + } else { + publisher := jobs["update_cache_memory"].(map[string]any) + assert.Contains(t, fmt.Sprint(publisher["steps"]), "actions/cache/save@") + assert.Contains(t, publisher["if"], "needs.detection.outputs.detection_success == 'true'") + if !ghes { + assert.Equal(t, "write-only", publisher["cache-mode"]) + } + } + if ghes { + assert.NotContains(t, content, "cache-mode:") + } else if dryRun { + assert.Equal(t, "read", compiled["cache-mode"]) + } else { + assert.NotContains(t, compiled, "cache-mode") + } + }) + } + } + } + } +} + +func TestCompiledCacheAccessNonemptyDependencyArray(t *testing.T) { + compiled, _ := compileCacheAccessFixture(t, "{push: {}, issue_comment: {}}", "true", false, false, false, + "cache:\n - key: dependencies\n path: node_modules\n") + jobs := compiled["jobs"].(map[string]any) + agent := jobs["agent"].(map[string]any) + assert.NotContains(t, agent, "cache-mode", "nonempty dependency caches must retain post-action saves") + assertDependencyCacheTrustGates(t, agent) + assert.Equal(t, "write-only", jobs["update_cache_memory"].(map[string]any)["cache-mode"]) +} + +func TestBuildMainJobRejectsMalformedDependencyCache(t *testing.T) { + for _, cache := range []string{"cache: [", "other: []"} { + t.Run(cache, func(t *testing.T) { + compiler := NewCompiler() + job, err := compiler.buildMainJob(&WorkflowData{Cache: cache}, false) + require.ErrorContains(t, err, "failed to parse cache configuration:") + assert.Nil(t, job) + }) + } +} + +func TestCachePublisherRequiresDetectionAcceptance(t *testing.T) { + data := &WorkflowData{ + CacheMemoryConfig: &CacheMemoryConfig{Caches: []CacheMemoryEntry{{ID: "default"}}}, + } + compiler := NewCompiler() + job, err := compiler.buildUpdateCacheMemoryJob(data, true) + require.NoError(t, err) + require.NotNil(t, job) + node, err := ParseExpression(stripExpressionWrapper(job.If)) + require.NoError(t, err) + for _, agent := range []string{"success", "failure", "cancelled", "skipped", ""} { + for _, detection := range []string{"success", "failure", "cancelled", "skipped", ""} { + for _, accepted := range []string{"true", "false", ""} { + for _, event := range cacheAccessTestEvents() { + values := map[string]string{ + "needs.agent.result": agent, + "needs.detection.result": detection, + "needs.detection.outputs.detection_success": accepted, + "github.event_name": event, + } + trusted := cacheAccessTestAllowsWrite(event) + assert.Equal(t, trusted && agent == "success" && detection == "success" && accepted == "true", + evaluateCacheTrustGate(t, node, values), + "event=%s agent=%s detection=%s detection_success=%s", event, agent, detection, accepted) + } + } + } + } +} + +func assertDependencyCacheTrustGates(t *testing.T, agent map[string]any) { + t.Helper() + for _, event := range cacheAccessTestEvents() { + var activeActions []string + for _, rawStep := range agent["steps"].([]any) { + step := rawStep.(map[string]any) + if step["name"] != "Cache (dependencies)" { + continue + } + condition, err := ParseExpression(stripExpressionWrapper(step["if"].(string))) + require.NoError(t, err) + if evaluateCacheTrustGate(t, condition, map[string]string{"github.event_name": event}) { + activeActions = append(activeActions, step["uses"].(string)) + } + } + require.Len(t, activeActions, 1, "event=%s", event) + if !cacheAccessTestAllowsWrite(event) { + assert.Contains(t, activeActions[0], "actions/cache/restore@") + } else { + assert.Contains(t, activeActions[0], "actions/cache@", "trusted dependency caches must retain their post-action save") + } + } +} + +func cacheAccessTestEvents() []string { + return append(append([]string{}, validGitHubEventTypes...), "", "future_untrusted_event") +} + +func cacheAccessTestAllowsWrite(event string) bool { + switch event { + case "push", "workflow_dispatch", "repository_dispatch", "delete", "registry_package", "page_build", "schedule", "pull_request": + return true + default: + return false + } +} + +func TestCacheWriteTriggerClassification(t *testing.T) { + readOnly := make(map[string]bool) + for _, event := range cachepolicy.ReadOnlyEvents() { + readOnly[event] = true + } + for _, event := range cacheAccessTestEvents() { + assert.Equal(t, cacheAccessTestAllowsWrite(event), cachepolicy.AllowsWrite(event), "event=%s", event) + } + for _, event := range validGitHubEventTypes { + assert.NotEqual(t, cachepolicy.AllowsWrite(event), readOnly[event], "each known event needs exactly one classification: %s", event) + } +} + +func evaluateCacheTrustGate(t *testing.T, node ConditionNode, values map[string]string) bool { + t.Helper() + switch node := node.(type) { + case *AndNode: + return evaluateCacheTrustGate(t, node.Left, values) && evaluateCacheTrustGate(t, node.Right, values) + case *OrNode: + return evaluateCacheTrustGate(t, node.Left, values) || evaluateCacheTrustGate(t, node.Right, values) + case *NotNode: + return !evaluateCacheTrustGate(t, node.Child, values) + case *ExpressionNode: + if property, expected, found := strings.Cut(node.Expression, " != '"); found { + expected, quoted := strings.CutSuffix(expected, "'") + require.True(t, quoted) + require.Contains(t, values, property) + return values[property] != expected + } + } + return evaluateDetectionRedactionGate(t, node, values) +} + +func compileCacheAccessFixture(t *testing.T, trigger, detection string, ghes, dryRun, restoreOnly bool, dependencyCache ...string) (map[string]any, string) { + t.Helper() + source := fmt.Sprintf(`--- +on: %s +strict: false +engine: copilot +permissions: + contents: read +tools: + github: false + cache-memory: + restore-only: %t +cache: + key: dependencies + path: node_modules +safe-outputs: + create-issue: + threat-detection: %s +jobs: + custom: + runs-on: ubuntu-latest + steps: + - run: echo custom +--- +Test cache access separation. +`, trigger, restoreOnly, detection) + if len(dependencyCache) > 0 { + source = strings.Replace(source, "cache:\n key: dependencies\n path: node_modules\n", dependencyCache[0], 1) + } + dir := t.TempDir() + path := filepath.Join(dir, "cache.md") + require.NoError(t, os.WriteFile(path, []byte(source), 0600)) + compiler := NewCompiler() + compiler.gitRoot = dir + compiler.SetSkipValidation(true) + compiler.SetGHESCompat(ghes) + compiler.SetDryRun(dryRun) + require.NoError(t, compiler.CompileWorkflow(path)) + content, err := os.ReadFile(filepath.Join(dir, "cache.lock.yml")) + require.NoError(t, err) + var compiled map[string]any + require.NoError(t, yaml.Unmarshal(content, &compiled)) + require.NoError(t, compiler.validateGitHubActionsSchemaFromParsed(compiled)) + return compiled, string(content) +} diff --git a/pkg/workflow/cache_memory.go b/pkg/workflow/cache_memory.go index a158826ec4d..c531c491ff1 100644 --- a/pkg/workflow/cache_memory.go +++ b/pkg/workflow/cache_memory.go @@ -553,16 +553,16 @@ func (c *Compiler) buildUpdateCacheMemoryJob(data *WorkflowData, threatDetection // Prepend setup steps to all cache steps steps = append(setupSteps, steps...) - // Job condition: run only if detection job succeeded (no threats found), - // AND the agent job succeeded (do not persist cache when agent failed or was skipped). - // Using always() so this condition is evaluated even if an upstream job is skipped/failed. - // Detection always runs when the agent ran (even for noop), so detection.result == 'success' - // is sufficient — detection short-circuits with success=true when there is nothing to analyze. + // Warning mode can leave the detection job successful with a rejected verdict. + // Require its explicit acceptance as well as successful agent/job completion. agentSucceeded := BuildEquals( BuildPropertyAccess(fmt.Sprintf("needs.%s.result", constants.AgentJobName)), BuildStringLiteral("success"), ) - jobCondition := RenderCondition(BuildAnd(BuildAnd(BuildFunctionCall("always"), buildDetectionSuccessCondition()), agentSucceeded)) + jobCondition := RenderCondition(BuildAnd( + BuildAnd(BuildAnd(BuildFunctionCall("always"), buildDetectionAcceptedCondition()), agentSucceeded), + cacheWriteAllowedCondition(), + )) // Set up permissions for the cache update job. // actions: write is required only when this job actually emits cache-save steps. @@ -595,6 +595,10 @@ func (c *Compiler) buildUpdateCacheMemoryJob(data *WorkflowData, threatDetection Env: jobEnv, Steps: steps, } + if !data.GHES && !data.DryRun { + // Only this detection-gated publisher may save; it never restores caches. + job.CacheMode = "write-only" + } return job, nil } diff --git a/pkg/workflow/cache_steps.go b/pkg/workflow/cache_steps.go index 6e417fa66d7..579c75234e3 100644 --- a/pkg/workflow/cache_steps.go +++ b/pkg/workflow/cache_steps.go @@ -6,6 +6,7 @@ import ( "os" "strings" + "github.com/github/gh-aw/pkg/workflow/cachepolicy" "github.com/goccy/go-yaml" ) @@ -27,12 +28,27 @@ func generateCacheSteps(builder *strings.Builder, data *WorkflowData, verbose bo for i, cache := range caches { if data.DryRun { writeCacheStepWithAction(builder, cache, i, len(caches), "actions/cache/restore") + } else if IsDetectionJobEnabled(data.SafeOutputs) { + // Match the runner's trigger-scoped cache-write boundary, including + // workflows that mix trusted and low-trust events. + trusted := cacheWriteAllowedCondition() + writeConditionalCacheStep(builder, cache, i, len(caches), "actions/cache", trusted) + writeConditionalCacheStep(builder, cache, i, len(caches), "actions/cache/restore", &NotNode{Child: trusted}) } else { writeCacheStep(builder, cache, i, len(caches)) } } } +// cacheWriteAllowedCondition grants writes only for platform-write-capable events. +func cacheWriteAllowedCondition() ConditionNode { + var terms []ConditionNode + for _, event := range cachepolicy.WriteEvents() { + terms = append(terms, BuildEquals(BuildPropertyAccess("github.event_name"), BuildStringLiteral(event))) + } + return BuildDisjunction(false, terms...) +} + func parseCacheStepConfigs(cacheYAML string) ([]map[string]any, error) { var topLevel map[string]any if err := yaml.Unmarshal([]byte(cacheYAML), &topLevel); err != nil { @@ -68,8 +84,15 @@ func writeCacheStep(builder *strings.Builder, cache map[string]any, idx int, tot } func writeCacheStepWithAction(builder *strings.Builder, cache map[string]any, idx int, total int, action string) { + writeConditionalCacheStep(builder, cache, idx, total, action, nil) +} + +func writeConditionalCacheStep(builder *strings.Builder, cache map[string]any, idx, total int, action string, condition ConditionNode) { stepName := resolveCacheStepName(cache, idx, total) fmt.Fprintf(builder, " - name: %s\n", stepName) + if condition != nil { + builder.WriteString(" if: ${{ " + RenderCondition(condition) + " }}\n") + } fmt.Fprintf(builder, " uses: %s\n", getActionPin(action)) builder.WriteString(" with:\n") writeCacheStepValue(builder, "key", cache["key"]) diff --git a/pkg/workflow/cachepolicy/events.go b/pkg/workflow/cachepolicy/events.go new file mode 100644 index 00000000000..2c297b9ad76 --- /dev/null +++ b/pkg/workflow/cachepolicy/events.go @@ -0,0 +1,33 @@ +// Package cachepolicy defines the trigger boundary for compiler-managed cache writes. +package cachepolicy + +import "slices" + +// WriteEvents returns GitHub's default-branch cache-write allowlist, plus +// pull_request, whose caches are isolated to the pull request's merge ref. +// https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#cache-access-for-low-trust-workflow-triggers +func WriteEvents() []string { + return []string{ + "push", "workflow_dispatch", "repository_dispatch", "delete", + "registry_package", "page_build", "schedule", "pull_request", + } +} + +// AllowsWrite fails closed for unknown events. Reusable workflows use the +// original caller's runtime event, not workflow_call. +func AllowsWrite(event string) bool { + return slices.Contains(WriteEvents(), event) +} + +// ReadOnlyEvents lists known events outside the write allowlist for authored +// trigger diagnostics. workflow_call requires review of the caller's policy. +func ReadOnlyEvents() []string { + return []string{ + "branch_protection_rule", "check_run", "check_suite", "create", + "deployment", "deployment_status", "discussion", "discussion_comment", + "fork", "gollum", "issue_comment", "issues", "label", "merge_group", + "milestone", "project", "project_card", "project_column", "public", + "pull_request_review", "pull_request_review_comment", "pull_request_target", + "release", "status", "watch", "workflow_call", "workflow_run", + } +} diff --git a/pkg/workflow/compiler_custom_job_detection.go b/pkg/workflow/compiler_custom_job_detection.go index ebb8178dc28..bfd75c87afd 100644 --- a/pkg/workflow/compiler_custom_job_detection.go +++ b/pkg/workflow/compiler_custom_job_detection.go @@ -83,8 +83,7 @@ func addCustomJobDetectionGuard(job *Job, statusOnly bool) error { if statusOnly { return nil } - // Warn-mode detections can report job success while flagging tainted output. - guard := "needs." + detection + ".result == 'success' && needs." + detection + ".outputs.detection_success == 'true'" + guard := RenderCondition(buildDetectionAcceptedCondition()) if condition != "" { guard += " && (" + condition + ")" } diff --git a/pkg/workflow/compiler_main_job.go b/pkg/workflow/compiler_main_job.go index 2146396fe40..dcfb2478997 100644 --- a/pkg/workflow/compiler_main_job.go +++ b/pkg/workflow/compiler_main_job.go @@ -20,6 +20,14 @@ func isBuiltinJobName(jobName string) bool { // The bulk of the construction is delegated to focused helpers in compiler_main_job_helpers.go. func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) (*Job, error) { workflowLog.Printf("Building main job for workflow: %s", data.Name) + hasDependencyCaches := false + if data.Cache != "" { + caches, err := parseCacheStepConfigs(data.Cache) + if err != nil { + return nil, fmt.Errorf("failed to parse cache configuration: %w", err) + } + hasDependencyCaches = len(caches) > 0 + } var steps []string setupActionRef := c.resolveActionReference("./actions/setup", data) @@ -63,6 +71,14 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) ( steps = append(steps, c.generateScriptModeCleanupStep()) } + cacheMode := "" + if !data.GHES && (data.DryRun || (IsDetectionJobEnabled(data.SafeOutputs) && !hasDependencyCaches)) { + // Restore-only actions alone do not restrict the job's scoped cache token. + // Dependency caches use the runner's trigger-scoped default instead: + // trusted events can save, while low-trust events retain read-only access. + cacheMode = "read" + } + compilerMainJobLog.Printf("Built main job: steps=%d, needs=%v, outputs=%d", len(steps), depends, len(outputs)) return &Job{ Name: string(constants.AgentJobName), @@ -72,6 +88,7 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) ( Container: c.indentYAMLLines(data.Container, " "), Services: c.indentYAMLLines(data.Services, " "), Permissions: c.indentYAMLLines(permissions, " "), + CacheMode: cacheMode, Concurrency: c.indentYAMLLines(agentConcurrency, " "), Env: env, Steps: steps, diff --git a/pkg/workflow/compiler_validation_test.go b/pkg/workflow/compiler_validation_test.go index 57aa4b0eb77..f7ed3058bc7 100644 --- a/pkg/workflow/compiler_validation_test.go +++ b/pkg/workflow/compiler_validation_test.go @@ -327,6 +327,72 @@ jobs: uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd`, wantErr: false, }, + { + name: "valid workflow cache mode", + yaml: `cache-mode: read +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo hello`, + }, + { + name: "valid job cache mode", + yaml: `on: push +jobs: + test: + cache-mode: write-only + runs-on: ubuntu-latest + steps: + - run: echo hello`, + }, + { + name: "valid reusable job cache mode", + yaml: `on: push +jobs: + test: + cache-mode: none + uses: ./.github/workflows/test.yml`, + }, + { + name: "invalid cache mode", + yaml: `cache-mode: invalid +on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo hello`, + wantErr: true, + errMsg: "cache-mode", + }, + { + name: "invalid step cache mode", + yaml: `on: push +jobs: + test: + runs-on: ubuntu-latest + steps: + - run: echo hello + cache-mode: read`, + wantErr: true, + errMsg: "cache-mode", + }, + { + name: "invalid expression with cache mode", + yaml: `cache-mode: read +on: push +jobs: + test: + runs-on: ubuntu-latest + env: + VALUE: '${{ github.ref + 1 }}' + steps: + - run: echo hello`, + wantErr: true, + errMsg: "unexpected symbol", + }, { name: "invalid workflow - missing jobs", yaml: `name: "Test Workflow" diff --git a/pkg/workflow/drive_memory.go b/pkg/workflow/drive_memory.go index c84fb60a5ac..337987bde92 100644 --- a/pkg/workflow/drive_memory.go +++ b/pkg/workflow/drive_memory.go @@ -237,7 +237,7 @@ func (c *Compiler) buildUpdateDriveMemoryJob(data *WorkflowData, threatDetection BuildPropertyAccess(fmt.Sprintf("needs.%s.result", constants.AgentJobName)), BuildStringLiteral("success"), ) - condition := RenderCondition(BuildAnd(BuildAnd(BuildFunctionCall("always"), buildDetectionSuccessCondition()), agentSucceeded)) + condition := RenderCondition(BuildAnd(BuildAnd(BuildFunctionCall("always"), buildDetectionAcceptedCondition()), agentSucceeded)) perms := NewPermissionsEmpty() perms.Set(PermissionContents, PermissionRead) perms.Set(PermissionIdToken, PermissionWrite) diff --git a/pkg/workflow/drive_memory_event_policy_test.go b/pkg/workflow/drive_memory_event_policy_test.go new file mode 100644 index 00000000000..874c65a926b --- /dev/null +++ b/pkg/workflow/drive_memory_event_policy_test.go @@ -0,0 +1,123 @@ +//go:build !integration + +package workflow + +import ( + "fmt" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/github/gh-aw/pkg/testutil" + "github.com/goccy/go-yaml" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const driveMemoryAcceptedCondition = "always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && needs.agent.result == 'success'" + +func TestCompiledDriveMemoryEventPolicy(t *testing.T) { + // Drives use the preview service's repository/ref/name namespace, not the + // Actions cache service's event-based publication policy. In particular, + // admitted slash commands must retain their validated drive writes. + for _, trigger := range []string{ + "push", + "workflow_dispatch", + "issue_comment", + "issues", + "discussion_comment", + "pull_request", + "pull_request_target", + "workflow_call", + "{push: {}, issue_comment: {}}", + "{workflow_call: {}, discussion_comment: {}}", + "{slash_command: {name: remember, events: [issues, issue_comment, pull_request_comment]}}", + } { + t.Run(trigger, func(t *testing.T) { + compiled, content := compileDriveMemoryEventFixture(t, trigger, "true", false, false, false) + jobs := compiled["jobs"].(map[string]any) + agent := extractJobSection(content, "agent") + publisher := jobs[updateDriveMemoryJobName].(map[string]any) + assert.Equal(t, driveMemoryAcceptedCondition, strings.Join(strings.Fields(publisher["if"].(string)), " ")) + assert.ElementsMatch(t, []any{"agent", "detection", "activation"}, publisher["needs"]) + assert.Equal(t, map[string]any{"contents": "read", "id-token": "write", "drives": "write"}, publisher["permissions"]) + assert.Contains(t, agent, "write: false") + assert.NotContains(t, agent, "actions/gh-drives-preview/commit@") + assert.Contains(t, agent, "Upload drive-memory data as artifact") + update := extractJobSection(content, updateDriveMemoryJobName) + assert.Contains(t, update, "write: true") + assert.Contains(t, update, "Check drive-memory for concurrent updates") + assert.Contains(t, update, "Validate drive-memory before commit") + assert.Contains(t, update, "actions/gh-drives-preview/commit@") + assert.NotContains(t, update, "cache-mode:") + }) + } +} + +func TestCompiledDriveMemoryPersistenceModes(t *testing.T) { + for _, detection := range []string{"true", "false", `"${{ vars.DETECT == 'true' }}"`} { + for _, ghes := range []bool{false, true} { + for _, dryRun := range []bool{false, true} { + for _, restoreOnly := range []bool{false, true} { + t.Run(fmt.Sprintf("detection=%s/ghes=%t/dry-run=%t/restore-only=%t", detection, ghes, dryRun, restoreOnly), func(t *testing.T) { + compiled, content := compileDriveMemoryEventFixture(t, "{push: {}, issue_comment: {}}", detection, ghes, dryRun, restoreOnly) + jobs := compiled["jobs"].(map[string]any) + agent := extractJobSection(content, "agent") + if dryRun || restoreOnly { + assert.Contains(t, agent, "write: false") + assert.NotContains(t, content, "actions/gh-drives-preview/commit@") + assert.NotContains(t, jobs, updateDriveMemoryJobName) + } else if detection == "false" { + assert.Contains(t, agent, "write: true") + assert.Contains(t, agent, "actions/gh-drives-preview/commit@") + assert.NotContains(t, jobs, updateDriveMemoryJobName) + } else { + assert.Contains(t, agent, "write: false") + assert.NotContains(t, agent, "actions/gh-drives-preview/commit@") + publisher := jobs[updateDriveMemoryJobName].(map[string]any) + assert.Equal(t, driveMemoryAcceptedCondition, strings.Join(strings.Fields(publisher["if"].(string)), " ")) + } + }) + } + } + } + } +} + +func compileDriveMemoryEventFixture(t *testing.T, trigger, detection string, ghes, dryRun, restoreOnly bool) (map[string]any, string) { + t.Helper() + dir := testutil.TempDir(t, "drive-memory-event-policy") + path := filepath.Join(dir, "drive.md") + source := fmt.Sprintf(`--- +on: %s +strict: false +engine: copilot +permissions: + contents: read +tools: + github: false + drive-memory: + drive-name: agent-state + restore-only: %t + allowed-extensions: [".json"] +safe-outputs: + create-issue: + threat-detection: %s +--- +Read the saved drive state and persist this admitted run's notes. +`, trigger, restoreOnly, detection) + require.NoError(t, os.WriteFile(path, []byte(source), 0600)) + compiler := NewCompiler() + compiler.gitRoot = dir + compiler.SetSkipValidation(true) + compiler.SetGHESCompat(ghes) + compiler.SetDryRun(dryRun) + require.NoError(t, compiler.CompileWorkflow(path)) + content, err := os.ReadFile(filepath.Join(dir, "drive.lock.yml")) + require.NoError(t, err) + var compiled map[string]any + require.NoError(t, yaml.Unmarshal(content, &compiled)) + require.NoError(t, compiler.validateGitHubActionsSchemaFromParsed(compiled)) + return compiled, string(content) +} diff --git a/pkg/workflow/drive_memory_test.go b/pkg/workflow/drive_memory_test.go index 428b2591a04..f90a4891c66 100644 --- a/pkg/workflow/drive_memory_test.go +++ b/pkg/workflow/drive_memory_test.go @@ -370,6 +370,8 @@ Use drive memory. assert.Contains(t, lockYAML, "id-token: write") assert.Contains(t, lockYAML, "contents: read") assert.Contains(t, lockYAML, "/tmp/gh-aw/drive-memory/") + assert.NotContains(t, lockYAML, updateDriveMemoryJobName+":") + assert.Contains(t, extractJobSection(lockYAML, "agent"), "actions/gh-drives-preview/commit@") } func TestCompileDriveMemoryThreatDetectionWorkflow(t *testing.T) { @@ -405,6 +407,7 @@ Use drive memory. assert.Contains(t, agentSection, "drives: read") assert.NotContains(t, agentSection, "actions/gh-drives-preview/commit@") assert.Contains(t, updateSection, "runs-on: ubuntu-latest") + assert.Contains(t, updateSection, "needs.detection.outputs.detection_success == 'true'") assert.Contains(t, updateSection, "drives: write") assert.Contains(t, updateSection, "Check drive-memory for concurrent updates") assert.Contains(t, updateSection, "refusing to overwrite a newer version") @@ -466,6 +469,31 @@ func TestDriveMemoryThreatDetectionJob(t *testing.T) { assert.Equal(t, "runs-on: ubuntu-latest", job.RunsOn) assert.Contains(t, job.Permissions, "drives: write") assert.Contains(t, strings.Join(job.Steps, "\n"), "actions/gh-drives-preview/commit@") + assert.Equal(t, driveMemoryAcceptedCondition, job.If) + + node, err := ParseExpression(job.If) + require.NoError(t, err) + for _, agentResult := range []string{"success", "failure", "cancelled", "skipped", ""} { + for _, detectionResult := range []string{"success", "failure", "cancelled", "skipped", ""} { + for _, accepted := range []string{"true", "false", ""} { + for _, event := range append(append([]string{}, validGitHubEventTypes...), "", "future_event") { + values := map[string]string{ + "github.event_name": event, + "needs.agent.result": agentResult, + "needs.detection.result": detectionResult, + "needs.detection.outputs.detection_success": accepted, + } + want := agentResult == "success" && detectionResult == "success" && accepted == "true" + assert.Equal(t, want, evaluateDetectionRedactionGate(t, node, values), + "event=%q agent=%q detection=%q detection_success=%q", event, agentResult, detectionResult, accepted) + } + } + } + } + + job, err = compiler.buildUpdateDriveMemoryJob(data, false) + require.NoError(t, err) + assert.Nil(t, job, "without detection, persistence remains in the agent job") } func TestDriveMemoryUpdateCheckoutStepIDsAreUnique(t *testing.T) { diff --git a/pkg/workflow/expression_builder.go b/pkg/workflow/expression_builder.go index 6745056fd03..0a427862684 100644 --- a/pkg/workflow/expression_builder.go +++ b/pkg/workflow/expression_builder.go @@ -298,10 +298,9 @@ func buildSkipAuthorAssociationsCondition(skipAuthorAssociations map[string][]st return &NotNode{Child: BuildDisjunction(false, skipTerms...)} } -// buildDetectionSuccessCondition builds the condition to check if detection passed. -// Detection runs in a separate detection job that only succeeds (result == 'success') when -// the analysis worked, the output was parsed, and no threats were found. When threats are -// detected the detection job exits with a non-zero code, giving it a 'failure' result. +// buildDetectionSuccessCondition checks whether the detection job completed successfully. +// Warn mode can report success even when threats were found; use +// buildDetectionAcceptedCondition when consuming or persisting agent output. func buildDetectionSuccessCondition() ConditionNode { return BuildEquals( BuildPropertyAccess(fmt.Sprintf("needs.%s.result", constants.DetectionJobName)), @@ -309,6 +308,17 @@ func buildDetectionSuccessCondition() ConditionNode { ) } +// buildDetectionAcceptedCondition also requires explicit acceptance of the agent output. +func buildDetectionAcceptedCondition() ConditionNode { + return BuildAnd( + buildDetectionSuccessCondition(), + BuildEquals( + BuildPropertyAccess(fmt.Sprintf("needs.%s.outputs.detection_success", constants.DetectionJobName)), + BuildStringLiteral("true"), + ), + ) +} + // buildDetectionPassedCondition builds the condition to check if the detection job either // succeeded (no threats found) or was skipped (agent produced no outputs or patch — nothing // to detect against). Use this for downstream jobs that must run in both cases. diff --git a/pkg/workflow/expression_builder_detection_test.go b/pkg/workflow/expression_builder_detection_test.go new file mode 100644 index 00000000000..0bea34e6b18 --- /dev/null +++ b/pkg/workflow/expression_builder_detection_test.go @@ -0,0 +1,27 @@ +//go:build !integration + +package workflow + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestBuildDetectionAcceptedCondition(t *testing.T) { + condition := RenderCondition(buildDetectionAcceptedCondition()) + assert.Equal(t, "needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true'", condition) + node, err := ParseExpression(condition) + require.NoError(t, err) + for _, result := range []string{"success", "failure", "cancelled", "skipped", ""} { + for _, accepted := range []string{"true", "false", ""} { + values := map[string]string{ + "needs.detection.result": result, + "needs.detection.outputs.detection_success": accepted, + } + assert.Equal(t, result == "success" && accepted == "true", evaluateDetectionRedactionGate(t, node, values), + "result=%q detection_success=%q", result, accepted) + } + } +} diff --git a/pkg/workflow/jobs.go b/pkg/workflow/jobs.go index f0519b9f2e4..d20da059124 100644 --- a/pkg/workflow/jobs.go +++ b/pkg/workflow/jobs.go @@ -55,6 +55,7 @@ type Job struct { HasWorkflowRunSafetyChecks bool // If true, the job's if condition includes workflow_run safety checks PermissionsComment string Permissions string + CacheMode string TimeoutMinutes int TimeoutMinutesExpression string Concurrency string // Job-level concurrency configuration @@ -329,6 +330,9 @@ func (jm *JobManager) renderJobTo(b *strings.Builder, job *Job) { if job.Permissions != "" { fmt.Fprintf(b, " %s\n", job.Permissions) //nolint:fprintferrorunchecked // strings.Builder writes cannot fail. } + if job.CacheMode != "" { + b.WriteString(" cache-mode: " + job.CacheMode + "\n") + } // Add concurrency section if job.Concurrency != "" { diff --git a/pkg/workflow/jobs_cache_mode_test.go b/pkg/workflow/jobs_cache_mode_test.go new file mode 100644 index 00000000000..7ab4398d3dd --- /dev/null +++ b/pkg/workflow/jobs_cache_mode_test.go @@ -0,0 +1,85 @@ +//go:build !integration + +package workflow + +import ( + "strings" + "testing" + + "github.com/goccy/go-yaml" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestJobManagerCacheMode(t *testing.T) { + for _, mode := range []string{"", "read", "write", "write-only", "none"} { + t.Run(mode, func(t *testing.T) { + for _, reusable := range []bool{false, true} { + jm := NewJobManager() + job := &Job{Name: "test", CacheMode: mode} + if reusable { + job.Uses = "./.github/workflows/worker.yml" + } else { + job.RunsOn = "runs-on: ubuntu-latest" + job.Steps = []string{" - run: echo data\n"} + } + require.NoError(t, jm.AddJob(job)) + require.NoError(t, jm.resolveActions()) + var output strings.Builder + jm.WriteJobsYAML(&output) + var parsed map[string]any + require.NoError(t, yaml.Unmarshal([]byte(output.String()), &parsed)) + fields := parsed["jobs"].(map[string]any)["test"].(map[string]any) + if mode == "" { + assert.NotContains(t, fields, "cache-mode") + assert.NotContains(t, output.String(), "cache-mode:") + } else { + assert.Equal(t, mode, fields["cache-mode"]) + assert.Contains(t, output.String(), " cache-mode: "+mode+"\n") + } + } + }) + } +} + +func TestJobManagerRejectsInvalidCacheMode(t *testing.T) { + tests := []struct { + name string + mode string + }{ + {"unsupported", "read-write"}, + {"case", "READ"}, + {"newline injection", "read\n permissions:\n contents: write"}, + {"carriage return injection", "read\r permissions: write-all"}, + {"crlf injection", "read\r\n permissions: write-all"}, + {"trailing newline", "read\n"}, + {"leading space", " read"}, + {"trailing space", "read "}, + {"space only", " "}, + {"tab", "read\t"}, + {"unicode whitespace", "read\u00a0"}, + {"nul", "read\x00"}, + {"escape", "read\x1b"}, + {"delete", "read\x7f"}, + {"yaml comment", "read # private"}, + {"yaml mapping", "{permissions: write-all}"}, + {"expression", "${{ inputs.cache-mode }}"}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + jm := NewJobManager() + job := &Job{Name: "test", CacheMode: tt.mode} + const message = "job 'test' cache-mode must be read, write, write-only, or none; omit cache-mode to use the default" + require.EqualError(t, jm.AddJob(job), message) + assert.Empty(t, jm.GetAllJobs()) + var output strings.Builder + jm.WriteJobsYAML(&output) + assert.Equal(t, "jobs:\n", output.String()) + + job.CacheMode = "read" + require.NoError(t, jm.AddJob(job)) + job.CacheMode = tt.mode + require.EqualError(t, jm.resolveActions(), message, "revalidate mutations before compiler emission") + }) + } +} diff --git a/pkg/workflow/jobs_validation.go b/pkg/workflow/jobs_validation.go index 68000131c4c..2d59afdc5b8 100644 --- a/pkg/workflow/jobs_validation.go +++ b/pkg/workflow/jobs_validation.go @@ -29,6 +29,12 @@ func validateJobDefinition(job *Job) error { return errors.New("job definition cannot be nil") } + switch job.CacheMode { + case "", "read", "write", "write-only", "none": + default: + return fmt.Errorf("job '%s' cache-mode must be read, write, write-only, or none; omit cache-mode to use the default", job.Name) + } + if job.Uses != "" && (job.TimeoutMinutes > 0 || job.TimeoutMinutesExpression != "") { return fmt.Errorf( "job '%s' uses a reusable workflow and cannot set timeout-minutes; remove timeout-minutes from the caller job or move it into the called workflow", diff --git a/pkg/workflow/lint/cache_poisoning.go b/pkg/workflow/lint/cache_poisoning.go index 10ab5ecce8f..8f599e2dc45 100644 --- a/pkg/workflow/lint/cache_poisoning.go +++ b/pkg/workflow/lint/cache_poisoning.go @@ -8,11 +8,11 @@ import ( "strings" ) -// CachePoisoningRule checks release/tag workflow cache restoration. It does not -// infer publication from job names or prove the provenance of cached files. +// CachePoisoningRule checks release/tag restores and explicit low-trust writes. +// It does not infer trust from job names or prove cached-file provenance. func CachePoisoningRule() Rule { return Rule{ - ID: "cache-poisoning", Description: "Keep release builds from restoring shared dependency caches", + ID: "cache-poisoning", Description: "Review shared cache restores and low-trust cache-write overrides", Severity: Warning, Targets: ActionsAST | AWAST, Check: checkCachePoisoning, } } @@ -21,6 +21,8 @@ func checkCachePoisoning(ctx context.Context, input Input) ([]Diagnostic, error) if err := integrityInput(ctx, input); err != nil { return nil, err } + blocks, blockErr := executionPolicyBlocks(ctx, input) + diagnostics, modeErr := cacheWriteOverrides(ctx, input, blocks) var on any if input.Workflow != nil { on = input.Workflow.On @@ -28,12 +30,20 @@ func checkCachePoisoning(ctx context.Context, input Input) ([]Diagnostic, error) on = input.Document.Frontmatter["on"] } release, err := cacheReleaseTrigger(ctx, on) - if err != nil || !release { - return nil, err + if err != nil { + return nil, errors.Join(modeErr, err) + } + lowTrust, err := cacheLowTrustTrigger(ctx, on) + if !lowTrust { + diagnostics = nil + } + if err != nil || (!release && !lowTrust) { + return diagnostics, errors.Join(modeErr, err) + } + failures := []error{blockErr, modeErr} + if !release { + return diagnostics, errors.Join(failures...) } - blocks, err := executionPolicyBlocks(ctx, input) - failures := []error{err} - var diagnostics []Diagnostic for _, block := range blocks { for _, step := range block.Steps { if err := ctx.Err(); err != nil { diff --git a/pkg/workflow/lint/cache_write_overrides.go b/pkg/workflow/lint/cache_write_overrides.go new file mode 100644 index 00000000000..60baf7e7f93 --- /dev/null +++ b/pkg/workflow/lint/cache_write_overrides.go @@ -0,0 +1,95 @@ +package lint + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/github/gh-aw/pkg/workflow/aw" + "github.com/github/gh-aw/pkg/workflow/cachepolicy" +) + +func cacheWriteOverrides(ctx context.Context, input Input, blocks []aw.ExecutionBlock) ([]Diagnostic, error) { + var root any + var present bool + if input.Workflow != nil { + root = input.Workflow.CacheMode + present = input.Workflow.CacheModeSet || input.Workflow.CacheMode != "" + } else { + root, present = input.Document.Frontmatter["cache-mode"] + } + rootMode, err := cachePolicyMode(root, "cache-mode", present) + var diagnostics []Diagnostic + failures := []error{err} + reported := make(map[string]struct{}) + check := func(value any, present bool, path string) { + field := "cache-mode" + if path != "" { + field = path + ".cache-mode" + } + mode, err := cachePolicyMode(value, field, present) + if err != nil { + failures = append(failures, err) + return + } + if mode == "" { + mode, field = rootMode, "cache-mode" + } + _, exists := reported[field] + if (mode == "write" || mode == "write-only") && !exists { + reported[field] = struct{}{} + diagnostics = append(diagnostics, Diagnostic{ + Path: field, + Message: "Explicit cache-write access can override the read-only default outside GitHub's write-capable trigger allowlist; " + + "use cache-mode: read for untrusted execution and review reusable callers, publisher input validation, and cache consumers", + }) + } + } + if input.Workflow != nil { + for _, job := range input.Workflow.Jobs { + if err := ctx.Err(); err != nil { + return diagnostics, errors.Join(append(failures, err)...) + } + check(job.CacheMode, job.CacheModeSet || job.CacheMode != "", "jobs."+string(job.ID)) + } + } else { + for _, block := range blocks { + if err := ctx.Err(); err != nil { + return diagnostics, errors.Join(append(failures, err)...) + } + if block.Path == "" || strings.HasPrefix(block.Path, "jobs.") || + strings.HasPrefix(block.Path, "safe-jobs.") || strings.HasPrefix(block.Path, "safe-outputs.jobs.") { + if block.Path != "" { + value, present := block.Fields["cache-mode"] + check(value, present, block.Path) + } else { + check(nil, false, "") + } + } + } + } + return diagnostics, errors.Join(failures...) +} + +func cacheLowTrustTrigger(ctx context.Context, on any) (bool, error) { + for _, event := range cachepolicy.ReadOnlyEvents() { + if _, found, err := authoredTrigger(ctx, on, event); err != nil || found { + return found, err + } + } + return false, nil +} + +func cachePolicyMode(value any, path string, present bool) (string, error) { + if !present { + return "", nil + } + if mode, ok := value.(string); ok { + switch mode { + case "read", "write", "write-only", "none": + return mode, nil + } + } + return "", fmt.Errorf("cache-poisoning requires read, write, write-only, or none at %s; correct the cache access mode before linting", path) +} diff --git a/pkg/workflow/lint/cache_write_overrides_test.go b/pkg/workflow/lint/cache_write_overrides_test.go new file mode 100644 index 00000000000..37d749fecfe --- /dev/null +++ b/pkg/workflow/lint/cache_write_overrides_test.go @@ -0,0 +1,204 @@ +package lint + +import ( + "context" + "encoding/json" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestCacheLowTrustWriteOverrides(t *testing.T) { + const message = "Explicit cache-write access can override the read-only default outside GitHub's write-capable trigger allowlist; use cache-mode: read for untrusted execution and review reusable callers, publisher input validation, and cache consumers" + for _, test := range []struct { + name, on, mode string + want bool + }{ + {"target write", "pull_request_target", "write", true}, + {"comment write only", "issue_comment", "write-only", true}, + {"issues write", "issues", "write-only", true}, + {"discussion write", "discussion", "write", true}, + {"discussion comment write", "discussion_comment", "write-only", true}, + {"mixed issues", "{push: {}, issues: {}}", "write-only", true}, + {"reusable caller unknown", "workflow_call", "write-only", true}, + {"workflow run write", "{workflow_run: {workflows: [CI], branches: [main]}}", "write", true}, + {"mixed events", "[push, issue_comment]", "write", true}, + {"mixed mapping", "{push: {}, pull_request_target: {}}", "write-only", true}, + {"low trust read", "pull_request_target", "read", false}, + {"low trust none", "workflow_run", "none", false}, + {"low trust default", "issue_comment", "", false}, + {"push writer", "push", "write", false}, + {"dispatch already defaults writable", "repository_dispatch", "write", false}, + {"manual writer", "workflow_dispatch", "write-only", false}, + {"merge ref isolated", "pull_request", "write", false}, + } { + for _, target := range []ASTTargets{ActionsAST, AWAST} { + t.Run(test.name+"/"+target.String(), func(t *testing.T) { + source := "on: " + test.on + "\n" + contractJob + contractSafeSteps + if test.mode != "" { + source += " cache-mode: " + test.mode + "\n" + } + input := ruleContractInput(t, source, target, false) + before, err := json.Marshal(input) + require.NoError(t, err) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.NoError(t, err) + if test.want { + require.Len(t, diagnostics, 1) + assert.Equal(t, "cache-poisoning", diagnostics[0].RuleID) + assert.Equal(t, Warning, diagnostics[0].Severity) + assert.Equal(t, "jobs.check.cache-mode", diagnostics[0].Path) + assert.Equal(t, message, diagnostics[0].Message) + } else { + assert.Empty(t, diagnostics) + } + again, err := runner.Run(context.Background(), input) + require.NoError(t, err) + assert.Equal(t, diagnostics, again) + after, err := json.Marshal(input) + require.NoError(t, err) + assert.Equal(t, before, after) + }) + } + } +} + +func TestCacheWriteModeInheritance(t *testing.T) { + for _, test := range []struct { + name, root, job, want string + }{ + {"inherited write", "write", "", "cache-mode"}, + {"inherited write only", "write-only", "", "cache-mode"}, + {"read overrides workflow write", "write", "read", ""}, + {"none overrides workflow write", "write-only", "none", ""}, + {"job overrides workflow read", "read", "write", "jobs.check.cache-mode"}, + {"job overrides workflow none", "none", "write-only", "jobs.check.cache-mode"}, + {"both write", "write", "write-only", "jobs.check.cache-mode"}, + } { + t.Run(test.name, func(t *testing.T) { + source := "on: issue_comment\ncache-mode: " + test.root + "\n" + contractJob + contractSafeSteps + if test.job != "" { + source += " cache-mode: " + test.job + "\n" + } + input := ruleContractInput(t, source, ActionsAST, false) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.NoError(t, err) + if test.want == "" { + assert.Empty(t, diagnostics) + } else { + require.Len(t, diagnostics, 1) + assert.Equal(t, test.want, diagnostics[0].Path) + } + }) + } +} + +func TestCacheIssueReusableCallerWriteOverride(t *testing.T) { + for _, target := range []ASTTargets{ActionsAST, AWAST} { + input := ruleContractInput(t, `on: {push: {}, issues: {}, discussion_comment: {}} +jobs: + call: + uses: ./.github/workflows/worker.yml + cache-mode: write-only +`, target, false) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.NoError(t, err) + require.Len(t, diagnostics, 1) + assert.Equal(t, "jobs.call.cache-mode", diagnostics[0].Path) + } +} + +func TestCacheWriterJobNamesDoNotEstablishTrust(t *testing.T) { + for _, target := range []ASTTargets{ActionsAST, AWAST} { + input := ruleContractInput(t, `on: issue_comment +jobs: + update_cache_memory: + runs-on: ubuntu-latest + cache-mode: write-only + steps: [{run: echo untrusted}] + call: + uses: ./.github/workflows/worker.yml + cache-mode: write +`, target, false) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.NoError(t, err) + var paths []string + for _, diagnostic := range diagnostics { + paths = append(paths, diagnostic.Path) + } + assert.ElementsMatch(t, []string{"jobs.call.cache-mode", "jobs.update_cache_memory.cache-mode"}, paths) + } +} + +func TestCacheWriteModePartialFailures(t *testing.T) { + input := ruleContractInput(t, `on: workflow_run +jobs: + invalid: + cache-mode: [PRIVATE_VALUE] + steps: [{run: echo data}] + publisher: + cache-mode: write-only + steps: [{run: echo data}] +`, AWAST, false) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.ErrorContains(t, err, "jobs.invalid.cache-mode") + assert.NotContains(t, err.Error(), "PRIVATE_VALUE") + require.Len(t, diagnostics, 1) + assert.Equal(t, "jobs.publisher.cache-mode", diagnostics[0].Path) + ctx, cancel := context.WithCancel(context.Background()) + cancel() + _, err = runner.Run(ctx, input) + assert.ErrorIs(t, err, context.Canceled) +} + +func TestCachePolicyUnrelatedTriggerIgnoresExecution(t *testing.T) { + input := ruleContractInput(t, "on: push\nsteps: not-a-step-list\n", AWAST, false) + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + diagnostics, err := runner.Run(context.Background(), input) + require.NoError(t, err) + assert.Empty(t, diagnostics) +} + +func TestCachePolicyLiteralValidation(t *testing.T) { + runner, err := Default().Select("cache-poisoning") + require.NoError(t, err) + for _, target := range []ASTTargets{ActionsAST, AWAST} { + for _, trigger := range []string{"", "push", "workflow_dispatch", "release", "workflow_call", "issue_comment"} { + for _, scope := range []string{"workflow", "job"} { + for _, mode := range []string{"read-only", `""`, "null", `" read"`, `"read "`, `"${{ 'read' }}"`} { + t.Run(target.String()+"/"+trigger+"/"+scope+"/"+mode, func(t *testing.T) { + source := "" + if trigger != "" { + source += "on: " + trigger + "\n" + } + path := "cache-mode" + if scope == "workflow" { + source += "cache-mode: " + mode + "\n" + } + source += contractJob + contractSafeSteps + if scope == "job" { + source += " cache-mode: " + mode + "\n" + path = "jobs.check.cache-mode" + } + input := ruleContractInput(t, source, target, false) + _, err := runner.Run(context.Background(), input) + require.ErrorContains(t, err, path) + assert.ErrorContains(t, err, "requires read, write, write-only, or none") + }) + } + } + } + } +} diff --git a/pkg/workflow/schema_validation.go b/pkg/workflow/schema_validation.go index d34edf1a179..d13b8d75985 100644 --- a/pkg/workflow/schema_validation.go +++ b/pkg/workflow/schema_validation.go @@ -85,7 +85,7 @@ func (c *Compiler) validateGitHubActionsSchema(yamlContent string) error { if err := c.validateGitHubActionsSchemaFromParsed(workflowData); err != nil { return err } - return actionslanguageservice.ValidateWorkflow("workflow.yml", yamlContent) + return actionslanguageservice.ValidateWorkflowWithCacheMode("workflow.yml", yamlContent) } // validateGitHubActionsSchemaFromParsed validates pre-parsed workflow data against the diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden index d93e3fa25be..99db9434a5f 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden @@ -447,6 +447,7 @@ jobs: discussions: read issues: read pull-requests: read + cache-mode: read timeout-minutes: 60 env: DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} @@ -3244,12 +3245,17 @@ jobs: - activation - agent - detection - if: always() && needs.detection.result == 'success' && needs.agent.result == 'success' + if: > + always() && needs.detection.result == 'success' && needs.detection.outputs.detection_success == 'true' && + needs.agent.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || github.event_name == 'delete' || github.event_name == 'registry_package' || + github.event_name == 'page_build' || github.event_name == 'schedule' || github.event_name == 'pull_request') runs-on: ubuntu-slim # Permissions for the update_cache_memory job (workflow permissions default to none). permissions: actions: write contents: read + cache-mode: write-only env: GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }} GH_AW_WORKFLOW_ID_SANITIZED: smokecopilot diff --git a/schemas/audit.schema.json b/schemas/audit.schema.json index 3cb26d86827..94781137dee 100644 --- a/schemas/audit.schema.json +++ b/schemas/audit.schema.json @@ -5887,6 +5887,88 @@ "matches" ], "additionalProperties": false + }, + "model_catalog": { + "type": [ + "null", + "object" + ], + "properties": { + "source": { + "type": "string" + }, + "models_fetch_complete": { + "type": "boolean" + }, + "endpoints": { + "type": [ + "null", + "array" + ], + "items": { + "type": "object", + "properties": { + "provider": { + "type": "string" + }, + "configured": { + "type": "boolean" + }, + "models": { + "type": [ + "null", + "array" + ], + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "supported_endpoints": { + "type": [ + "null", + "array" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "id" + ], + "additionalProperties": false + } + }, + "warning": { + "type": "string" + } + }, + "required": [ + "provider", + "configured", + "models" + ], + "additionalProperties": false + } + }, + "warnings": { + "type": [ + "null", + "array" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "source", + "models_fetch_complete", + "endpoints" + ], + "additionalProperties": false } }, "required": [ diff --git a/schemas/logs-jsonl.schema.json b/schemas/logs-jsonl.schema.json index 84c671cbc4e..3b73d7fb132 100644 --- a/schemas/logs-jsonl.schema.json +++ b/schemas/logs-jsonl.schema.json @@ -9878,6 +9878,88 @@ "matches" ], "additionalProperties": false + }, + "model_catalog": { + "type": [ + "null", + "object" + ], + "properties": { + "source": { + "type": "string" + }, + "models_fetch_complete": { + "type": "boolean" + }, + "endpoints": { + "type": [ + "null", + "array" + ], + "items": { + "type": "object", + "properties": { + "provider": { + "type": "string" + }, + "configured": { + "type": "boolean" + }, + "models": { + "type": [ + "null", + "array" + ], + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "supported_endpoints": { + "type": [ + "null", + "array" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "id" + ], + "additionalProperties": false + } + }, + "warning": { + "type": "string" + } + }, + "required": [ + "provider", + "configured", + "models" + ], + "additionalProperties": false + } + }, + "warnings": { + "type": [ + "null", + "array" + ], + "items": { + "type": "string" + } + } + }, + "required": [ + "source", + "models_fetch_complete", + "endpoints" + ], + "additionalProperties": false } }, "required": [ diff --git a/specs/compiler-threat-detection-changelog.md b/specs/compiler-threat-detection-changelog.md index 70e55a3e273..72907aa86b6 100644 --- a/specs/compiler-threat-detection-changelog.md +++ b/specs/compiler-threat-detection-changelog.md @@ -16,9 +16,12 @@ This changelog records the version history and the dated mapping audits for `spe | Version | Change | |---|---| -| 1.0.76 | Adds literal `checkout.pull-request-floating-head`, default false, as an explicit current-head/non-approval alternative to event revision binding. Preserves SHA fetch, fetch-time revalidation, actual-HEAD verification, authorization, and checkout-disable policies. No new compiler threat rule or permission grant. | -| 1.0.75 | Maps runtime immutable PR revision isolation and actual-HEAD verification, replacing the moving-ref description. Records event/review revision binding, fail-closed stale revision and dispatch context checks, event-only revision propagation, and explicit current-head/non-approval semantics for issue comments and unbound manual dispatch. Preserves actor/bot authorization, checkout provenance policy, credential and sparse/shallow behavior, and independent safe-output lifecycle checks. No new compiler threat identifier, permission grant, or lock-file schema change. | -| 1.0.74 | Specifies the default Actions/AW `privileged-checkout` and `artifact-execution` warning contracts, mapping adversarial, benign, registry, and compiler integration evidence. Separates unsafe checkout opt-outs and direct source selection from authorization, and cross-run workspace extraction or modeled execution from artifact authenticity. Includes token-gated built-in cross-run lookup, context-aware workspace and runner-temp paths with ancestor containment, metadata-only npm commands, clone source operands, forced PR refspecs, additional commit selectors, a boolean-guarded landed merge-SHA exception with bounded dependency/status propagation, atomic multiline interpolation, and runner-default shell boundaries. Also clarifies pwn-request compiler coverage versus runtime and deployment trust, including trusted custom execution, immutable-pin currency, actor versus historical-revision approval, upstream artifact-as-data handling, host/cache persistence and separation, platform-policy limits with date-independent effective-policy checks, opt-outs, and safe-output warn mode. Preserves data-only consumers, current-run artifacts, strict PRT policy and clean-detection gates, direct template-injection protections, offline compilation, and full-SHA pinning. Unknown or historical SHAs are not assigned invented vulnerability status. No new threat identifier, runtime enforcement, compiler rejection, permission grant, or lock-file schema change. | +| 1.0.79 | Clarifies drive-memory's separate persistence boundary: admitted issue/slash-command runs retain detection-accepted writes through repository/ref/drive-name preview storage, not Actions cache event/token policy. Documents cross-event content reuse, unverified service-side enforcement, detector limitations, and dry-run/restore-only/no-detection behavior. Adds exact generated-YAML and event/result regression evidence without changing production behavior, threat identifiers, or lock-file compatibility. | +| 1.0.78 | Synchronizes CTR-019 with the implemented cache lifecycle: restore and local edits, artifact handoff, stricter successful-agent/detection/event publication gates, optional validation, and later restoration. Records policy-hash/custom-key/repository-scope limits, artifact-only retention, and the absence of retroactive cache authentication or purge. Distinguishes platform cache-token read policies, entry restore-only configuration, dry-run, and host-side MCP read-only compilation. Maps compiler sink validation, native scalar handling, namespace/lifecycle regressions, and the limits of existing workflow/safe-output/MCP TLA+ models. Documentation/evidence clarification only; no new runtime behavior, threat identifier, or lock-file compatibility change. | +| 1.0.77 | Closes the empty dependency-cache list exception to the detection-enabled agent's read-only cache policy: only parsed, nonempty entries preserve dependency-save capability. Requires independent validation of workflow- and job-level cache-mode literals before actionlint compatibility suppression, including trusted events without cache actions. Maps empty-list generated-YAML, invalid-scalar CLI, and reusable-caller regression coverage. Preserves valid dependency saves, dry-run, GHES, and no-detection boundaries; no new threat identifier, frontmatter setting, or lock-file schema change. | +| 1.0.76 | Fixes an incomplete cache-write denylist that allowed issue/discussion runs to override GitHub's default-branch read-only cache boundary. Publisher and dependency-save guards now share a fail-closed allowlist matching the seven documented write-capable events plus merge-ref-isolated `pull_request`; missing and unknown events are denied. Extends known-event lint diagnostics, mixed-trigger and reusable-caller coverage, and the acceptance matrix, including accepted no-output results. Preserves dry-run, GHES, dispatch, and no-detection boundaries. Also adds literal `checkout.pull-request-floating-head`, default false, as an explicit current-head/non-approval alternative to event revision binding, preserving SHA fetch, fetch-time revalidation, actual-HEAD verification, authorization, and checkout-disable policies. Generated locks require regeneration for cache access; no new threat identifier or permission grant. | +| 1.0.75 | Blocks cache-memory publication on `pull_request_target`, `issue_comment`, and `workflow_run` regardless of detector acceptance, preventing low-trust publication into trusted cache lineages. Preserves trusted dependency-cache saves through runtime-conditioned actions and trigger-scoped tokens, explicitly documenting their pre-detection write capability. Shares the detection-acceptance helper with drive-memory publication and custom-job guards. Extends narrow actionlint compatibility to job-level cache policies while preserving malformed-value and misplaced-key errors. Maps trust/save, rejection, dry-run, and compatibility tests; generated locks require regeneration. Also maps runtime immutable PR revision isolation and actual-HEAD verification, replacing the moving-ref description: event/review revision binding, fail-closed stale revision and dispatch context checks, event-only revision propagation, and explicit current-head/non-approval semantics for issue comments and unbound manual dispatch. Preserves actor/bot authorization, checkout provenance policy, credential and sparse/shallow behavior, and independent safe-output lifecycle checks. No new threat identifier, frontmatter setting, permission grant, or lock-file schema change. | +| 1.0.74 | Strengthens CTR-019 with read-only agent cache tokens, restore-only frontmatter dependency caches, a separate write-only cache-memory publisher, and explicit detector acceptance in addition to successful jobs. Specifies warning/failed/skipped/missing detection handling, dry-run precedence, the existing CLI/config GHES opt-out, and unchanged no-detection behavior. Maps effective low-trust explicit-write diagnostics and generated-YAML/acceptance regression coverage. Separates capability grants from artifact authenticity and records GHES, custom-job, unsigned-content, and persistent-runner limitations. Also specifies the default Actions/AW `privileged-checkout` and `artifact-execution` warning contracts, mapping adversarial, benign, registry, and compiler integration evidence. Separates unsafe checkout opt-outs and direct source selection from authorization, and cross-run workspace extraction or modeled execution from artifact authenticity. Includes token-gated built-in cross-run lookup, context-aware workspace and runner-temp paths with ancestor containment, metadata-only npm commands, clone source operands, forced PR refspecs, additional commit selectors, a boolean-guarded landed merge-SHA exception with bounded dependency/status propagation, atomic multiline interpolation, and runner-default shell boundaries. Clarifies pwn-request compiler coverage versus runtime and deployment trust, including trusted custom execution, immutable-pin currency, actor versus historical-revision approval, upstream artifact-as-data handling, host/cache persistence and separation, platform-policy limits with date-independent effective-policy checks, opt-outs, and safe-output warn mode. Preserves data-only consumers, current-run artifacts, strict PRT policy and clean-detection gates, direct template-injection protections, offline compilation, and full-SHA pinning. Unknown or historical SHAs are not assigned invented vulnerability status. Generated locks require regeneration for cache access changes; the new review warnings add no runtime enforcement. No new threat identifier, compiler rejection, permission grant, frontmatter setting, or lock-file schema change. | | 1.0.72 | Audit-only clarification that same-repository bot PR `labeled` events remain subject to the RS-05a collaborator permission floor. No new threat identifier, permission grant, or lock-file schema change. | | 1.0.71 | Added a separate compiler-only `artipacked` exception for agent checkouts immediately followed by compiler-owned credential cleanup and verification. Requires current-compilation provenance, unique full-block parsed-field matching, exact adjacency, and statically proven discovery coverage; altered, authored, ambiguous, interrupted, deep-path, and unknown-path blocks remain warned. Preserves runtime YAML, per-checkout authentication, other diagnostics, and standalone lint. Maps adversarial, discovery-depth boundary, multi-repository, sparse-checkout, compilation, and provenance-reset regressions. | | 1.0.70 | Specifies generated admission-output gating for agent, threat-detection, evals, and conclusion usage/session steps. Disabled admission emits no activation admission-output references; dry-run component execution omits admission environment bindings. Preserves component-specific budget selection and independent grader, daily-credit, and job-duration bindings. Also specifies the compiler-only `artipacked` warning exception for retained-credential checkouts in the exact generated `safe_outputs` PR checkout/authentication block, requiring current-compilation provenance, a unique full-block parsed-field match, and provenance reset between workflows; modified or ambiguous blocks remain ineligible. Preserves authored-step and other-job diagnostics, other rules, errors, analysis failures, standalone lint, and runtime authentication. Maps admission-only lint compilation, component/usage, exclusion, multi-repository, compiler integration, and reuse regressions. Regeneration removes stale references; no new threat identifier, permission grant, or lock-file schema change. | diff --git a/specs/compiler-threat-detection-spec.md b/specs/compiler-threat-detection-spec.md index 19c4c385817..dc747c3ed4e 100644 --- a/specs/compiler-threat-detection-spec.md +++ b/specs/compiler-threat-detection-spec.md @@ -7,7 +7,7 @@ sidebar: # GitHub Actions Compiler Threat Detection Specification -**Version**: 1.0.76 +**Version**: 1.0.79 **Status**: Candidate Recommendation **Latest Version**: https://github.com/github/gh-aw/blob/main/specs/compiler-threat-detection-spec.md **Editors**: GitHub Next (GitHub, Inc.) @@ -32,9 +32,12 @@ Each version maps to the minimum compatible binary. A version change MUST update | Versions | Minimum gh-aw | Compatibility | |---|---:|---| -| `1.0.76` | Unreleased | Adds explicit `checkout.pull-request-floating-head` current-head selection, default false. Preserves SHA fetch/verification and authorization; does not establish revision approval or add a compiler threat rule. | -| `1.0.75` | Unreleased | Maps immutable PR checkout and actual-HEAD verification to the runtime boundary: event/review revision binding, stale revision rejection, fail-closed dispatch context, and explicit current-head/non-approval semantics for issue comments and unbound manual dispatch. No new compiler threat identifier, permission grant, or lock-file schema change. | -| `1.0.74` | Unreleased | Specifies bounded Actions/AW `privileged-checkout` and `artifact-execution` review warnings for privileged custom source selection and cross-run artifact execution, and clarifies pwn-request compiler coverage versus runtime and deployment trust: host/cache persistence, producer-code trust, approval-to-revision binding, action version currency, custom executable steps, platform policies with date-independent effective-policy checks, and safe-output warn mode. Preserves strict PRT enforcement, offline pin integrity, data-only consumers, and explicit analysis limits. No new threat identifier, runtime enforcement, compiler rejection, permission grant, or lock-file schema change. | +| `1.0.79` | Unreleased | Distinguishes drive-memory persistence from Actions cache event/token policy. Documents admitted issue/slash-command writes, repository/ref/drive scope, cross-event residual trust, explicit acceptance, and dry-run/restore-only/no-detection boundaries. Adds generated-YAML and event/result evidence; no runtime or lock-file compatibility change. | +| `1.0.78` | Unreleased | Documents the implemented cache-memory restore/edit/artifact/publication lifecycle, integrity namespaces and restore scope, and distinct meanings of read-only policies. Maps lifecycle and mode-validation evidence and separates CTR-019 from the host-side MCP read-only and safe-output lifecycle models. Documentation/evidence clarification only; no new runtime behavior, threat identifier, or lock-file compatibility change. | +| `1.0.77` | Unreleased | Requires parsed, nonempty dependency-cache entries before omitting the detection-enabled agent's read-only cache policy; `cache: []` retains the restriction. Requires trigger-independent validation of authored cache-mode literals before actionlint compatibility suppression. No new threat identifier, frontmatter setting, or lock-file schema change. | +| `1.0.76` | Unreleased | Replaces the incomplete cache-write event denylist with GitHub's documented write allowlist plus merge-ref-isolated `pull_request`. Publisher and dependency-save guards deny all other and unknown events, including issues/discussions; known-event lint diagnostics share the classification. Also adds explicit `checkout.pull-request-floating-head` current-head selection, default false, preserving SHA fetch/verification and authorization without establishing revision approval or adding a compiler threat rule. Generated locks require regeneration; no new threat identifier or frontmatter setting for cache access. | +| `1.0.75` | Unreleased | Blocks detection-separated cache-memory publication on low-trust events, restores trusted dependency-cache saves using trigger-scoped tokens, and shares explicit detection acceptance across cache/drive publishers and custom jobs. Adds job-level actionlint compatibility without suppressing invalid locations or values. Also maps immutable PR checkout and actual-HEAD verification to the runtime boundary: event/review revision binding, stale revision rejection, fail-closed dispatch context, and explicit current-head/non-approval semantics for issue comments and unbound manual dispatch. Generated locks require regeneration for cache access; no new threat identifier, frontmatter setting, permission grant, or lock-file schema change. | +| `1.0.74` | Unreleased | Strengthens CTR-019 with detection-separated agent/publisher cache access and explicit detector acceptance. Specifies the existing GHES compatibility opt-out, dry-run precedence, low-trust explicit-write warnings, and unchanged no-detection behavior. Also specifies bounded Actions/AW `privileged-checkout` and `artifact-execution` review warnings for privileged custom source selection and cross-run artifact execution, and clarifies pwn-request compiler coverage versus runtime/deployment trust: host/cache persistence, producer-code trust, approval-to-revision binding, action version currency, custom executable steps, date-independent effective platform-policy checks, and safe-output warn mode. Preserves strict PRT enforcement, offline pin integrity, data-only consumers, and explicit analysis limits. Generated locks require regeneration for cache access changes; the new review warnings add no runtime enforcement. No new threat identifier, compiler rejection, permission grant, or lock-file schema change. | | `1.0.73` | Unreleased | Audit-only clarification that same-repository bot PR `edited` checkout is a runtime trust control restricted to allow-listed actors and body-only changes under Security Architecture Specification RS-05a. No new threat identifier, permission grant, or lock-file schema change. | | `1.0.72` | Unreleased | Audit-only clarification that same-repository bot PR `labeled` events remain subject to the collaborator permission floor under Security Architecture Specification RS-05a. No new threat identifier, permission grant, or lock-file schema change. | | `1.0.71` | Unreleased | Adds a separate compiler-only `artipacked` exception for agent checkouts immediately followed by exact compiler-owned cleanup and credential verification. Requires current-compilation provenance, unique full-block matching, and statically proven cleanup discovery coverage; runtime authentication and standalone lint remain unchanged. | @@ -174,7 +177,7 @@ Each rule has a stable `CTR-*` ID, threat class, trigger, compiler action, diagn - **CTR-016 Compile-Time Manifest Drift**: Reject new restricted secrets or action references absent from an existing manifest. - **CTR-017 Secret Leakage via Environment Variables and Telemetry**: Warn, or reject in strict mode, for uncontrolled secret-expression placement. The Actions/AW linter MUST report secret-tainted values configured as OTLP span or resource attributes, including modeled Actions environment flows, without reproducing the values in diagnostics. This lint check is advisory and does not prove the absence of hard-coded credentials or arbitrary runtime disclosures. When OTLP is enabled and the effective AWF version supports `--exclude-env`, generated agent, threat-detection, and evals AWF invocations using `--env-all` MUST exclude `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, and `GH_AW_OTLP_ENDPOINTS`. These values MUST remain available to host-side exporters. Both inline and external threat-detection paths and evals execution MUST preserve the exclusions. Workflows without OTLP MUST NOT gain these OTLP-specific exclusions unless independently required by another exclusion policy. - **CTR-018 Version Integrity Bypass**: Warn, or reject in strict mode, for `check-for-updates: false`. -- **CTR-019 Cache-Memory Integrity Enforcement**: Require cache updates only after successful agent and threat-detection jobs. +- **CTR-019 Cache-Memory Integrity Enforcement**: When detection is enabled, separate agent cache access from cache-memory publication and require successful agent and detection jobs plus explicit detector acceptance before publication, subject to the compatibility boundaries in Section 5.1.3. - **CTR-020 Conditional Import Security**: Reject `imports` entries containing `if`. - **CTR-021 Workflow Run Trigger Branch Scope**: Warn, or reject in strict mode, for unscoped `workflow_run`; always reject missing `workflows`. - **CTR-022 Git Subprocess Argument Injection**: Reject unsafe remote ref/path arguments before invoking Git. @@ -219,6 +222,62 @@ The compiler MUST reject creation of an authored custom job under a reserved bui The Actions/AW `custom-job-detection` linter MUST check transitive ordering, require a direct detection dependency for downstream custom jobs, and prove detection job success on every runnable branch when status functions override implicit success. The linter checks the supplied graph and conditions; the compiler independently enforces the stronger clean-output gate. AW-only analysis MUST NOT claim resolved-import coverage. Actions analysis MUST require both `agent` and `detection` jobs, so ordinary CI detection jobs do not activate this policy. Without companion source, standalone Actions analysis uses the shared compiler-owned name policy, including generated state-push and memory-maintenance jobs; this classification is not proof of job provenance. Source-backed analysis MUST distinguish authored jobs from compiler-generated maintenance jobs. +### 5.1.3 Cache Access and Publication (CTR-019) + +When detection is enabled and GHES compatibility mode is disabled, the compiler MUST emit `cache-mode: read` on the agent job unless parsed, nonempty frontmatter dependency-cache entries require the platform's trigger-scoped default token. An empty list (`cache: []`) MUST NOT activate this exception. Publisher and dependency-save guards MUST allow only `push`, `workflow_dispatch`, `repository_dispatch`, `delete`, `registry_package`, `page_build`, `schedule`, and merge-ref-isolated `pull_request`. Every other event, including `issues`, `discussion`, `discussion_comment`, missing events, and unknown future events, MUST fail closed. Dependency caches MUST select restore-only actions outside this allowlist and combined restore/save actions inside it. This MUST work in mixed-trigger workflows, reusable workflows using the original caller's runtime event, and expression-controlled detection. `workflow_call` itself MUST NOT grant cache writes. Allowed dependency-cache saves are intentionally not detection-gated; the agent retains direct cache-write capability on those events. Selecting a restore-only action alone does not restrict the job's scoped cache token. + +Writable cache-memory entries MUST use a separate publisher requiring `needs.agent.result == 'success'`, `needs.detection.result == 'success'`, and `needs.detection.outputs.detection_success == 'true'` before configured memory validation and saving. The publisher MUST additionally require an allowlisted runtime event so accepted low-trust output cannot populate a cache lineage later restored by trusted runs. Failed, cancelled, skipped, or missing detection results, missing acceptance outputs, and warning-mode rejection MUST block publication even if the detection job reports success. Cache-memory and drive-memory publishers and ordinary downstream custom-job guards MUST share the explicit detection-acceptance condition. The detector's internal no-output short-circuit still reports acceptance; this MUST NOT be described as proof that every cached file was scanned or as authorization for events outside the write allowlist. + +Outside GHES compatibility mode, the publisher MUST use `cache-mode: write-only`; its runtime event guard MUST prevent that explicit capability from overriding the low-trust defaults on an executing job. The compiler MUST NOT impose a workflow-wide read cap that prevents intended trusted publication during ordinary execution. This capability boundary MUST NOT be described as artifact authenticity, provenance, or attestation. Dry-run MUST omit the publisher and MUST NOT acquire write capability through a job-level override. Dry-run MUST use restore-only compiler-managed cache actions and, outside GHES compatibility mode, workflow-level and agent-job `cache-mode: read`. Entries marked `restore-only: true` MUST NOT be published. + +The existing `gh aw compile --ghes` flag and `.github/workflows/aw.json` setting `"ghes": true` MUST omit compiler-generated workflow and job `cache-mode` fields, including dry-run fields. GitHub.com availability does not establish support in a deployed GHES release; compatibility mode MUST NOT claim scoped-token enforcement there. It retains cache-memory restore-only agent actions, publisher event/validation gates, and event-conditioned dependency-cache actions, without assuming the deployed server enforces GitHub.com's token defaults. This compatibility switch also selects GHES artifact-action pins; it is not an independent cache-service capability negotiation. + +Without detection, existing same-job cache-memory behavior MUST remain unchanged, except for independent dry-run restrictions. Custom jobs retain their own cache-access boundary. The Actions/AW `cache-poisoning` linter MUST warn about effective explicit `write` or `write-only` overrides for known events outside the write allowlist, including issue/discussion events, workflow-level inheritance, and reusable callers whose effective runtime event is unknown; a job-level `read` or `none` overrides inherited write access. Job names MUST NOT establish publisher trust. `repository_dispatch` MUST NOT be classified as having the platform's low-trust read-only default. + +Authored workflow- and job-level `cache-mode` values MUST be validated independently of trigger classification before unsupported-key actionlint diagnostics are suppressed. Only literal `read`, `write`, `write-only`, and `none` policies are supported; explicit empty or null values MUST NOT be treated as an absent policy. Unsupported scalars MUST NOT pass lint solely because the event is write-eligible or no cache action exists. + +These controls do not authenticate unsigned cache contents or uploaded artifacts, prove arbitrary shell/third-party cache writers safe, or cover persistent runner caches. Conformance evidence MUST cover generated YAML for low-trust, trusted, mixed, dispatch, dry-run, GHES, no-detection, empty dependency-cache lists, and legitimate publisher cases, plus detector-result and acceptance-output combinations and trigger-independent invalid-mode diagnostics. + +#### Drive-memory persistence is a separate boundary + +The detection-separated drive-memory publisher MUST require successful agent and detection jobs and explicit detection acceptance, including rejection in warning mode. It MUST preserve supported admitted issue and slash-command writes rather than apply the Actions cache event allowlist. The pinned GitHub Drives preview action requests repository/ref/drive-name storage; drive persistence MUST NOT be described as Actions cache storage or as constrained by `cache-mode`. + +Runs sharing the requested repository, `GITHUB_REF`, and drive name can exchange persistent content across event types. Detection acceptance, local Git bookkeeping, concurrency checks, and configured validation MUST NOT be described as producer authentication or proof that later interpretation is safe. Detector false negatives and its no-output short-circuit remain residual risks. The compiler does not establish server-side namespace enforcement by the preview service. Deployments requiring stronger producer isolation MUST NOT rely on detection acceptance alone. + +Dry-run and restore-only drive entries MUST omit compiler-managed publication. Without detection, writable drives retain their existing same-job publication without a detection gate. Conformance evidence in `drive_memory_test.go` and `drive_memory_event_policy_test.go` MUST cover exact acceptance guards, event/result combinations, mixed and reusable triggers, admitted slash commands, expression-controlled detection, GHES, dry-run, restore-only, and no-detection behavior. + +#### Cache lifecycle and poisoning boundaries + +The detection-separated lifecycle has distinct local, artifact, and cache-service effects: + +| Phase | Compiler-managed behavior | Trust boundary | +|---|---|---| +| Restore and prepare | Restore cache-memory with `actions/cache/restore`, then initialize the integrity-branch workspace and configured pre-agent sanitization. | A cache hit is input, not approval of its producer or contents. | +| Agent edits | The agent can modify local memory files. Writable entries receive local Git commits and configured post-agent validation. | Local file writes and Git history are not cache-service publication or provenance. | +| Artifact handoff | Writable entries are uploaded for the downstream publisher, subject to configured validation. These steps can run after agent failure; reusable calls use invocation-specific artifact names. | Artifact existence or a successful upload MUST NOT imply detector acceptance or permission to save a cache. | +| Publication gate | The publisher requires a successful agent, successful detection, explicit acceptance, and an allowlisted runtime event. | A rejected, failed, missing, or runtime-skipped detection result MUST block publication even if an artifact already exists. This is stricter than safe-output paths that may process valid requests after agent failure. | +| Validate and save | The publisher downloads the current invocation's memory artifact, checks for content, requires configured validation to succeed, and saves through `actions/cache/save`. If every entry is restore-only, no publisher is generated. | Validation enforces its configured content policy, not general artifact authenticity. The write-only job does not restore caches. | +| Later restore | Subsequent runs select entries through the integrity/policy namespace and configured restore prefixes, subject to platform cache visibility. | Previously published data remains untrusted input; neither a cache hit nor a prior accepted run proves safe future interpretation. | + +Generated cache-memory save and restore keys MUST retain the integrity-level and policy-hash namespace, including when a custom key suffix is configured. The policy hash is a truncated configuration digest, not a signature, producer identity, or collision-resistant authenticity guarantee. Default keys include the workflow identifier and run ID; restore prefixes permit reuse across runs. Repository scope intentionally adds cross-workflow restoration within the namespace. Custom key choices and repository scope MUST NOT be described as universal workflow isolation. These namespaces do not encode event trust, so they MUST NOT replace the runtime publication event gate. + +The configured cache-memory `retention-days` is emitted on the intermediate artifact upload; it MUST NOT be described as a cache-service expiry, secure deletion, or revocation policy. GitHub cache visibility, eviction, and already-existing entries remain platform/operator concerns. This hardening does not retroactively authenticate or purge caches created under older policies. + +#### Read-only models and evidence limits + +| Read-only mechanism | What it restricts | What it does not establish | +|---|---|---| +| Job `cache-mode: read` | The GitHub.com job's scoped cache-service write capability. | Local memory immutability, content authenticity, or a restriction on every credential/custom writer available to the job. Repository `permissions: read-all` alone is not this cache-token boundary. | +| Entry `restore-only: true` | Compiler-managed persistence for that entry: restore instead of combined restore/save, and no post-agent commit, validation/upload, or publisher save for it. | A read-only filesystem or a per-entry token restriction; other configured dependency caches can still require job-wide write capability. | +| Dry-run | Compiler-managed cache actions are restore-only and the cache-memory publisher is omitted; supported platform tokens are capped to read. | General script side-effect freedom or GHES scoped-token enforcement. | +| MCP read-only compilation | Compilation-controlled filesystem/image-store preservation and cached-only import use under `MCP-COMPILE-*`. | Runtime Actions cache-token restrictions or the trustworthiness of cached imported content. Ordinary CLI `--no-emit` is not the stronger MCP read-only mode. | + +For the scoped platform cache token, `none` disables both reads and writes, `read` permits restoration without writes, `write` permits reads and writes, and `write-only` permits writes without cache reads. Omitting the policy retains platform defaults and applicable caller restrictions; omission MUST NOT be interpreted as `none` or as proof of read-only access. An explicit low-trust write override is a deliberate capability-boundary change, not automatic authenticity. + +Compiler job registration and pre-emission validation MUST reject noncanonical cache-mode strings rather than concatenate unchecked policy text into generated YAML. Empty compiler-internal values mean omission, not permission to accept an explicitly empty authored policy. Native Actions scalar serialization MUST preserve YAML structure; parsing or emitting a scalar alone is not enum validation. + +[`CompiledWorkflow.tla`](workflow-security/CompiledWorkflow.tla) models job/artifact/credential ordering, while [`SafeOutputTransport.tla`](workflow-security/SafeOutputTransport.tla) and [`SafeOutputGit.tla`](workflow-security/SafeOutputGit.tla) model safe-output transport and Git lifecycles. None models cache-service entries, eviction, event-scoped token grants, or cache-memory publication as a separate principal. [`MCPCompile.tla`](workflow-security/MCPCompile.tla) models host compilation and import-cache mutation, not runtime cache poisoning. CTR-019 evidence therefore comes from the mapped generated-YAML, lifecycle, namespace, and lint tests; passing these bounded models MUST NOT be presented as a proof of cache non-poisonability or compiler refinement. + ### 5.2 Compiler Response Requirements The compiler MUST produce deterministic, actionable diagnostics and either reject insecure generation or apply a safe rewrite for every active rule in Section 5.1. @@ -301,7 +360,7 @@ Every active rule MUST map to implementation and test coverage. References are p | CTR-016 Compile-Time Manifest Drift | safe-update, strict env/update, cache, and expression builder | corresponding enforcement, secrets, update, and cache tests | | CTR-017 Secret Leakage via Environment Variables and Telemetry | safe-update, strict env/update, cache, and expression builder; `pkg/workflow/awf_command_builder.go`, `threat_detection_external.go`, `evals_steps.go`; AST subsets: `pkg/workflow/lint/secrets.go`, `otlp_secret_leak.go`, `pkg/workflow/taint/` | corresponding enforcement, secrets, update, cache, and OTLP leak tests; `TestOTLPEnvExcludedFromAWFSandboxes` in `awf_env_test.go`, `TestEvalsOTLPEnvExcludedFromSandbox` in `evals_steps_test.go`, `TestCompiledOTLPEnvExcludedFromAgentDetectionAndEvals` in `threat_detection_isolation_test.go`; `pkg/workflow/taint/taint_test.go`, `pkg/workflow/lint/otlp_secret_leak_test.go` | | CTR-018 Version Integrity Bypass | safe-update, strict env/update, cache, and expression builder | corresponding enforcement, secrets, update, and cache tests | -| CTR-019 Cache-Memory Integrity Enforcement | safe-update, strict env/update, cache, and expression builder | corresponding enforcement, secrets, update, and cache tests | +| CTR-019 Cache-Memory Integrity Enforcement | `pkg/workflow/compiler_main_job.go`, `cache_memory.go`, `cache_integrity.go`, `cache_steps.go`, shared `cachepolicy/events.go`, `compiler_yaml_post_agent.go`, `drive_memory.go`, `expression_builder.go`, `compiler_yaml.go`, `jobs_validation.go`; GHES configuration in `compiler.go`; native policy presence/scalar handling in `actions/parse.go`, `actions/lower.go`; AST subset: `pkg/workflow/lint/cache_poisoning.go`, `cache_write_overrides.go` | `pkg/workflow/cache_access_test.go`, `cache_integrity_test.go`, `cache_memory_threat_detection_test.go`, `cache_memory_restore_only_test.go`, `cache_memory_restore_keys_test.go`, `cache_scope_validation_test.go`, `cache_retention_days_validation_test.go`, `compiler_jobs_memory_test.go`, `compiler_development_test.go`, `jobs_cache_mode_test.go`, `drive_memory_test.go`, `expression_builder_detection_test.go`; `pkg/workflow/actions/parse_test.go`, `pkg/workflow/lint/cache_write_overrides_test.go`, `pkg/cli/lint_cache_mode_test.go` | | CTR-020 Conditional Import Security | `pkg/parser/import_bfs.go` | `pkg/parser/import_bfs_test.go` | | CTR-021 Workflow Run Trigger Branch Scope | `agent_validation.go`, `agentic_engine.go`, `pkg/gitutil/gitutil.go`; AST subset: `pkg/workflow/lint/workflow_run_scope.go` | workflow-run, bash-allowlist, gitutil, and download tests; `pkg/workflow/lint/workflow_run_scope_test.go` | | CTR-022 Git Subprocess Argument Injection | `agent_validation.go`, `agentic_engine.go`, `pkg/gitutil/gitutil.go` | workflow-run, bash-allowlist, gitutil, and download tests | @@ -459,7 +518,7 @@ Each active rule MUST have at least one deterministic test that covers its prima | **T-CTR-016** | CTR-016 Compile-Time Manifest Drift | Reject new restricted secrets or action references absent from an existing manifest | Reject new restricted secrets or action references absent from an existing manifest. | `CTR-016` | | **T-CTR-017** | CTR-017 Secret Leakage via Environment Variables and Telemetry | Uncontrolled secret-expression placement, secret-tainted values in OTLP attributes, or OTLP-enabled agent/threat-detection/evals AWF generation with `--exclude-env` support | Warn, or reject in strict mode, for uncontrolled secret-expression placement; report secret-tainted OTLP span/resource attributes with value-free diagnostics; exclude all three host-side OTLP variables from agent, inline/external detection, and evals sandboxes while retaining them for host exporters; preserve behavior without OTLP. | `CTR-017` | | **T-CTR-018** | CTR-018 Version Integrity Bypass | Warn, or reject in strict mode, for `check-for-updates: false` | Warn, or reject in strict mode, for `check-for-updates: false`. | `CTR-018` | -| **T-CTR-019** | CTR-019 Cache-Memory Integrity Enforcement | Require cache updates only after successful agent and threat-detection jobs | Require cache updates only after successful agent and threat-detection jobs. | `CTR-019` | +| **T-CTR-019** | CTR-019 Cache-Memory Integrity Enforcement | Detection-separated cache access, explicit publication acceptance, and compatibility boundaries | Verify generated cache modes, GHES omission, dry-run precedence, trigger combinations, low-trust write warnings, and failed/missing/rejected detector gates under Section 5.1.3. | `CTR-019` | | **T-CTR-020** | CTR-020 Conditional Import Security | Reject `imports` entries containing `if` | Reject `imports` entries containing `if`. | `CTR-020` | | **T-CTR-021** | CTR-021 Workflow Run Trigger Branch Scope | Warn, or reject in strict mode, for unscoped `workflow_run`; always reject missing `workflows` | Warn, or reject in strict mode, for unscoped `workflow_run`; always reject missing `workflows`. | `CTR-021` | | **T-CTR-022** | CTR-022 Git Subprocess Argument Injection | Reject unsafe remote ref/path arguments before invoking Git | Reject unsafe remote ref/path arguments before invoking Git. | `CTR-022` | diff --git a/specs/workflow-security/README.md b/specs/workflow-security/README.md index 4e091b7e433..c8d6cbc608d 100644 --- a/specs/workflow-security/README.md +++ b/specs/workflow-security/README.md @@ -64,6 +64,23 @@ fail. Agent failures revoke the modeled engine credential. A minted installation token remains live until the `actions/create-github-app-token` post step, which revokes it after either safe-output success or failure. +## Cache lifecycle and read-only boundaries + +The compiler's [CTR-019 cache contract](../compiler-threat-detection-spec.md#513-cache-access-and-publication-ctr-019) +separates cache restoration and local edits from artifact handoff and +detection-gated cache publication. Unlike the safe-output lifecycle above, +the cache-memory publisher requires the agent job to succeed as well as +explicit detector acceptance and an eligible runtime event. Artifact existence +does not authorize publication. + +These models do not represent cache-service entries, restore-prefix matching, +eviction, event-scoped cache tokens, or the cache-memory publisher principal. +The host-side `MCPCompile.tla` model's read-only filesystem/import-cache +invariants are independent of runtime job `cache-mode: read`. Entry +`restore-only: true` also does not make the local workspace immutable. +Generated-YAML, namespace, lifecycle, and lint tests mapped under CTR-019 are +the current evidence; the models are not a cache-poisoning proof. + ## Pull-request fork admission [`PullRequestForkAdmission.tla`](PullRequestForkAdmission.tla) models the