Prevent `GH_AW_TOOLS_META_JSON` expression-size overflows in compiled workflows by Copilot · Pull Request #53965 · github/gh-aw

Copilot · 2026-08-19T10:33:20Z

The daily compatibility audit surfaced a compiler-side regression: large, compiler-generated GH_AW_TOOLS_META_JSON blocks could fail compilation when they contained ${{ }} expressions and crossed GitHub Actions’ 21KB expression-bearing limit. This failure mode affected otherwise valid workflows with large tool metadata.

Compiler path: sanitize tools-meta expression payload
- In pkg/workflow/mcp_setup_safe_outputs.go, added tools-meta runtime data preparation that:
  - detects ${{ ... }} in generated tools meta JSON,
  - rewrites them to ${GH_AW_*} placeholders in the emitted YAML block scalar,
  - emits corresponding step env bindings so values can be restored at runtime.
- This removes raw template expressions from the large YAML value while preserving semantics.
Runtime path: resolve placeholders before materializing tools_meta.json
- In actions/setup/js/generate_safe_outputs_tools.cjs, added placeholder resolution for GH_AW_TOOLS_META_JSON prior to writing tools_meta.json.
- Runtime behavior stays consistent; only transport/encoding of expression-bearing content changes.
Regression coverage
- Added targeted tests for:
  - Go-side tools-meta expression extraction/sanitization,
  - JS-side placeholder resolution when GH_AW_TOOLS_META_JSON is provided via env.

sanitized, envKeys, envValues := buildToolsMetaRuntimeData(toolsMetaJSON)
// sanitized: ... "${GH_AW_*}" ...
// envValues: GH_AW_* -> "${{ ... }}"

Fixes [aw-compat] Daily AW compat audit (2026-08-19): 8/20 repos fail after fix, gh search code unavailable #53949

Generated by PR Sous Chef run https://github.com/github/gh-aw/actions/runs/32249206937> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.7 AIC · ⌖ 8.26 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-19T10:54:15Z

@copilot add tests

Copilot

Pull request overview

Prevents oversized expression-bearing tools metadata from exceeding GitHub Actions limits.

Changes:

Replaces embedded expressions with runtime environment placeholders.
Resolves placeholders before generating tools metadata.
Adds Go and JavaScript regression tests.

Show a summary per file

File	Description
`pkg/workflow/mcp_setup_safe_outputs.go`	Sanitizes tools metadata expressions.
`pkg/workflow/mcp_setup_safe_outputs_test.go`	Tests expression extraction.
`actions/setup/js/generate_safe_outputs_tools.cjs`	Restores runtime placeholders.
`actions/setup/js/generate_safe_outputs_tools.test.cjs`	Tests placeholder resolution.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-08-19T19:59:00Z

+ * @returns {string}
+ */
+function resolveEnvStringPlaceholders(value) {
+  return value.replace(/\$\{([A-Z_][A-Z0-9_]*)\}/g, (match, envName) => process.env[envName] ?? match);


Fixed in e403f67: resolveEnvStringPlaceholders now JSON-escapes the resolved env value (JSON.stringify(value).slice(1, -1)) before splicing it into the JSON text, so quotes/backslashes/newlines in the resolved value no longer corrupt tools_meta.json. Added regression tests covering these characters.

Copilot · 2026-08-19T19:59:05Z

+	sanitizedToolsMeta := toolsMetaJSON
+	for _, expr := range sliceutil.SortedKeys(expressionEnvVars) {
+		envName := expressionEnvVars[expr]
+		envValues[envName] = expr


Fixed in e403f67: buildToolsMetaRuntimeData now decodes the matched JSON string fragment via decodeJSONStringFragment (reversing encoding/json's HTML-escaping of <, >, &) before storing it as the step env value, while still replacing the encoded form in sanitizedToolsMeta. Added TestBuildToolsMetaRuntimeDataDecodesHTMLEscapedExpression to cover this.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-19T11:08:49Z

@copilot add tests

Added tests in 3e2b5f6 (approx, see latest commit): Go tests for buildToolsMetaRuntimeData covering multiple distinct expressions and deduped repeated expressions, plus JS tests for GH_AW_TOOLS_META_JSON covering multiple placeholders and unresolved placeholders.

@copilot add tests

Added tests in 8b6b0ba: Go tests for buildToolsMetaRuntimeData covering multiple distinct expressions and deduped repeated expressions, plus JS tests for GH_AW_TOOLS_META_JSON covering multiple placeholders and unresolved placeholders.

gh-aw-bot · 2026-08-19T11:53:06Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.

Failed checks to revisit after your update:
- lint-js — https://github.com/github/gh-aw/actions/runs/32246157384/job/96051212369
Please refresh the branch if needed.
Then run the pr-finisher skill before handing back for maintainer review.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.7 AIC · ⌖ 8.26 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

gh-aw-bot · 2026-08-19T12:05:08Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.

There are unresolved review comments about JSON-safe placeholder substitution in generate_safe_outputs_tools.cjs and encoded expression restoration in buildToolsMetaRuntimeData; please fix both and reply on-thread.
Please refresh the branch if needed after the fixes land.
Then run the pr-finisher skill before handing back for maintainer review.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14 AIC · ⌖ 8.19 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-19T12:15:17Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.

There are unresolved review comments about JSON-safe placeholder substitution in `generate_safe_outputs_too...

Fixed both in e403f67:

generate_safe_outputs_tools.cjs: resolveEnvStringPlaceholders now JSON-escapes the resolved env value (via JSON.stringify(...).slice(1,-1)) before splicing it into the JSON text, so quotes/backslashes/newlines in the value no longer corrupt tools_meta.json.
mcp_setup_safe_outputs.go: buildToolsMetaRuntimeData now decodes the matched JSON string fragment (reversing encoding/json's HTML-escaping of <, >, &, etc.) before storing it as the step env value, while still replacing the encoded form in sanitizedToolsMeta.

Added regression tests for both.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-08-19T12:26:27Z

PR Triage

Category: bug
Risk: high
Priority score: 74/100 (impact 40 + urgency 22 + quality 12)
Recommended action: fast_track

Compiler fix: prevents GH_AW_TOOLS_META_JSON from exceeding GitHub Actions 21KB expression limit, a real compile-blocking regression.

Generated by 🔧 PR Triage Agent · auto · 44.3 AIC · ⌖ 2.78 AIC · ⊞ 8.3K · ◷

gh-aw-bot · 2026-08-19T13:08:27Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please refresh the branch if needed.
Then run the pr-finisher skill and leave a concise maintainer-visible handoff comment with validation and any remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.53 AIC · ⌖ 8.14 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T13:19:05Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please refresh the branch if needed....

Verified the branch is up to date and both prior review threads (JSON-safe placeholder escaping in generate_safe_outputs_tools.cjs, HTML-escape decoding in buildToolsMetaRuntimeData) are already fixed in e403f67/900b17f, with regression tests passing locally.

Local validation on HEAD (900b17f):

make fmt — clean, no diff.
make lint — 0 errors; only pre-existing warnings and one pre-existing testifylint failure in pkg/intent/governance_formal_test.go (untouched by this PR, last modified in [docs] Update glossary - daily scan #53961).
Go tests: TestBuildToolsMetaRuntimeData* (5 cases) pass.
JS tests: generate_safe_outputs_tools.test.cjs (32 cases) pass, including prettier formatting check.
make recompile — no diff, all 286 workflows compile clean.
go build ./... — clean.

I can't resolve the two GitHub review-thread conversations from this environment (no thread-resolve capability available to me), but their underlying issues are fixed in code as noted above. CI on this HEAD hasn't re-run since my push and needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a new push) to go green.

Remaining: awaiting maintainer review/approval (mergeable_state is blocked pending requested reviews from @pelikhan and @gh-aw-bot).

github-actions · 2026-08-19T18:30:19Z

PR Triage

Category: bug · Risk: high · Score: 70/100 (impact 35 + urgency 25 + quality 10)
Recommended action: fast_track

Critical compiler correctness fix (expression-size overflow) with CI green; review history has churn (dismissed review) — highest score, needs prompt human attention.

Automated triage — see run report for full details.

Generated by 🔧 PR Triage Agent · auto · 90.2 AIC · ⌖ 2.82 AIC · ⊞ 8.3K · ◷

gh-aw-bot · 2026-08-19T19:54:15Z

@copilot This PR looks close, but it still still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:

Resolve or answer any remaining unresolved review thread(s) directly on-thread.
Refresh the branch if GitHub offers one.
Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment with validation and remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 31.4 AIC · ⌖ 8.18 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T19:59:25Z

@copilot This PR looks close, but it still still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:...

Replied on-thread to both previously unresolved review comments (r3812371390, r3812371435) confirming the fixes landed in e403f67, with commit references and test names. I don't have a thread-resolve capability in this environment, so the threads remain open pending a maintainer/reviewer marking them resolved.

Branch base is unchanged (still on main@4bb738f) — no refresh needed, not behind.

Local validation on HEAD (900b17f), re-verified:

make fmt — clean, no diff.
make lint — 0 errors; only pre-existing warnings plus one pre-existing testifylint failure in pkg/intent/governance_formal_test.go (unrelated, last touched by [docs] Update glossary - daily scan #53961).
Go tests TestBuildToolsMetaRuntimeData* (5 cases) — pass.
JS tests generate_safe_outputs_tools.test.cjs (32 cases) — pass, prettier clean.
make recompile — no diff, 286/286 workflows compile clean.
go build ./... — clean.

Remaining risk/blocker: mergeable_state is blocked pending requested reviews from @pelikhan and @gh-aw-bot — not actionable from this environment. CI on this HEAD is stale since my last push and needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a new push).

gh-aw-bot · 2026-08-19T20:59:46Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:

Resolve or answer the remaining unresolved review threads directly on-thread.
Refresh the branch if GitHub offers one.
Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment with validation and remaining risks.

Open review threads (newest first):

Copilot: decode HTML-escaped JSON string fragments before re-emitting GitHub Actions expressions — Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflows #53965 (comment)
Copilot: JSON-escape env placeholder substitutions before splicing into serialized tools metadata — Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflows #53965 (comment)

If both are already fixed on the current head, reply on-thread with the exact commit/test evidence so reviewers can resolve them quickly.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 19.9 AIC · ⌖ 8.28 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T21:04:24Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:...

Both threads already have on-thread replies with commit/test evidence from the prior pass: r3816286526 and r3816287113. No code changed since then; HEAD is still 900b17f, branch is not behind main, and local validation (fmt/lint/tests/recompile/build) remains green as previously reported. Resolving the threads requires maintainer/reviewer action, which I can't do from this environment.

Initial plan

e83a799

Copilot AI assigned Copilot and pelikhan Aug 19, 2026

Copilot started work on behalf of pelikhan August 19, 2026 10:33 View session

Copilot AI linked an issue Aug 19, 2026 that may be closed by this pull request

[aw-compat] Daily AW compat audit (2026-08-19): 8/20 repos fail after fix, gh search code unavailable #53949

Open

Copilot AI and others added 2 commits August 19, 2026 10:45

Avoid oversized expression-bearing tools meta block

dda8f8b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Handle tools-meta expressions via runtime placeholders

b4510fa

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Audit daily compatibility for AW with repositories~~ Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflows Aug 19, 2026

Copilot finished work on behalf of pelikhan August 19, 2026 10:51

Copilot AI requested a review from pelikhan August 19, 2026 10:51

pelikhan marked this pull request as ready for review August 19, 2026 10:54

Copilot AI balanced review requested due to automatic review settings August 19, 2026 10:54

Copilot started reviewing on behalf of pelikhan August 19, 2026 10:54 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 19, 2026 11:02 View session

github-actions Bot mentioned this pull request Aug 19, 2026

[pr-sous-chef] pr-sous-chef run report #53885

Open

Add regression tests for tools-meta placeholder handling

8b6b0ba

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 19, 2026 11:09

Merge branch 'main' into copilot/aw-compat-daily-audit

94d1f04

Copilot started work on behalf of gh-aw-bot August 19, 2026 11:53 View session

Fix prettier formatting in eslint-factory test file

ff5bae3

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 19, 2026 12:02

Copilot AI requested a review from gh-aw-bot August 19, 2026 12:02

Copilot started work on behalf of gh-aw-bot August 19, 2026 12:05 View session

Fix JSON-safe placeholder resolution and expression decoding

e403f67

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Document invariant for decodeJSONStringFragment

900b17f

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 19, 2026 12:17

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:high pr-risk:high pr-type:bug labels Aug 19, 2026

github-actions Bot mentioned this pull request Aug 19, 2026

[PR Triage Report] PR Triage Report — 2026-08-19 (Run 32251836165) #53992

Closed

Copilot started work on behalf of gh-aw-bot August 19, 2026 13:09 View session

Copilot finished work on behalf of gh-aw-bot August 19, 2026 13:19

github-actions Bot mentioned this pull request Aug 19, 2026

[PR Triage Report] PR Triage Report — 2026-08-19 (Run 32286379053) #54060

Open

Copilot started work on behalf of gh-aw-bot August 19, 2026 19:54 View session

Copilot finished work on behalf of gh-aw-bot August 19, 2026 19:59

Copilot started work on behalf of gh-aw-bot August 19, 2026 21:00 View session

Copilot finished work on behalf of gh-aw-bot August 19, 2026 21:04

Uh oh!

Conversation

Copilot AI commented Aug 19, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

Copilot AI commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

PR Triage

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

Copilot AI commented Aug 19, 2026

Uh oh!

github-actions Bot commented Aug 19, 2026

PR Triage

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

Copilot AI commented Aug 19, 2026

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

Copilot AI commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 19, 2026 •

edited by github-actions Bot

Loading

Copilot AI commented Aug 19, 2026 •

edited

Loading