Give GitHubReposScope a concrete type by Copilot · Pull Request #55793 · github/gh-aw

Copilot · 2026-08-25T13:59:43Z

GitHubReposScope used any, forcing consumers to handle scalar strings and YAML-parsed arrays independently. This change normalizes both supported YAML forms into a typed string slice.

Type
- Define GitHubReposScope as []string.
- Add YAML unmarshalling for scalar and list forms.
- Reject non-string list entries.
Consumers
- Normalize repository scopes during tool parsing.
- Remove redundant type switches from validation, policy hashing, and dry-run reporting.
- Preserve omitted versus explicitly empty scopes.

allowed-repos: all

allowed-repos:
  - github/gh-aw
  - github/docs

Both forms now produce:

GitHubReposScope{"all"}
GitHubReposScope{"github/gh-aw", "github/docs"}

Fixes [deep-report] Give GitHubReposScope a real type instead of bare any #55770

pr-sous-chef run: https://github.com/github/gh-aw/actions/runs/32874927562

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 31.4 AIC · ⌖ 8.24 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-25T16:22:29Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

Copilot

Pull request overview

Introduces a concrete repository-scope type for GitHub guard policies and simplifies downstream handling.

Changes:

Normalizes scalar and list scopes into GitHubReposScope.
Simplifies validation, hashing, and reporting.
Updates affected tests.

Show a summary per file

File	Description
`pkg/workflow/tools_types.go`	Defines typed scope and YAML decoding.
`pkg/workflow/tools_parser.go`	Normalizes parsed scope values.
`pkg/workflow/tools_validation_github.go`	Validates typed scopes.
`pkg/workflow/tools_validation_test.go`	Updates validation coverage.
`pkg/workflow/tools_validation_github_test.go`	Updates alias-validation tests.
`pkg/workflow/tools_types_test.go`	Tests normalization and YAML decoding.
`pkg/workflow/cache_integrity.go`	Simplifies scope canonicalization.
`pkg/workflow/cache_integrity_test.go`	Updates policy-hash fixtures.
`pkg/cli/compile_guard_policy_report.go`	Simplifies scope reporting.
`pkg/cli/compile_guard_policy_report_test.go`	Updates report fixtures.

Review details

Files reviewed: 10/10 changed files
Comments generated: 1
Review effort level: Balanced

Copilot · 2026-08-25T20:13:17Z

+			value, ok := repo.(string)
+			if !ok {
+				return GitHubReposScope{}
+			}


Addressed by ad17985 and covered again in c60b4f2: parseGitHubReposScope now returns contextual errors through both guard-policy validation and ParseToolsConfig for mixed non-string arrays.

github-actions · 2026-08-25T16:31:11Z

Comment Memory

reviewed_at: 2026-08-25T00:00:00Z
review_event: REQUEST_CHANGES
top_themes:
  - guard-policy validation regression
  - malformed allowed-repos widens to default all
files_reviewed:
  - pkg/cli/compile_guard_policy_report.go
  - pkg/cli/compile_guard_policy_report_test.go
  - pkg/workflow/cache_integrity.go
  - pkg/workflow/cache_integrity_test.go
  - pkg/workflow/tools_parser.go
  - pkg/workflow/tools_types.go
  - pkg/workflow/tools_types_test.go
  - pkg/workflow/tools_validation_github.go
  - pkg/workflow/tools_validation_github_test.go
  - pkg/workflow/tools_validation_test.go
comment_count: 1

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 10.1 AIC · ⌖ 6.98 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

github-actions

Request changes

The new concrete GitHubReposScope type is a good cleanup direction, but this patch currently turns malformed allowed-repos input into the implicit default scope instead of rejecting it.

Blocking theme

Invalid allowed-repos shapes are normalized to an empty slice during parsing, and later treated as “field omitted”.
That means bad guard-policy configuration can now bypass validation and widen to allowed-repos: all, which is the opposite of fail-closed behavior for an access-control setting.
Please preserve explicit validation failures for unsupported scalar types and non-string array entries, then add regression coverage for parser + validator integration.

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 10.1 AIC · ⌖ 6.98 AIC · ⊞ 7K
_{Comment /review to run again}

github-actions · 2026-08-25T16:31:13Z

+		for _, repo := range repos {
+			value, ok := repo.(string)
+			if !ok {
+				return GitHubReposScope{}


This change silently reclassifies malformed allowed-repos values as “not configured”, which means invalid frontmatter can now bypass the min-integrity requirement and get defaulted to all instead of failing fast.

💡 Why this blocks merge

Before this patch, an unsupported type like allowed-repos: 42 or a mixed array failed validation because validateReposScope still saw the original value and returned an explicit type error. Now parseGitHubReposScope converts every unsupported shape into an empty slice, and validateGitHubGuardPolicy treats that as if the field were omitted (hasRepos := github.AllowedRepos != nil is false for an empty slice). That changes invalid policy input into permissive defaulting:

tools: github: allowed-repos: 42 min-integrity: approved

With the new parser, that reaches:

config.AllowedRepos = GitHubReposScope{} hasRepos := github.AllowedRepos != nil // false github.AllowedRepos = GitHubReposScope{"all"}

So a bad config no longer produces a schema/validation error; it broadens access to all. Please preserve parse/validation failure for unsupported scalar types and mixed/non-string arrays, and add a regression test around invalid allowed-repos input going through NewTools(...) + validateGitHubGuardPolicy(...).

Addressed by ad17985 and covered again in c60b4f2: unsupported scalar and mixed-array scopes fail before defaulting, with min-integrity: approved regression coverage through NewTools validation and ParseToolsConfig.

gh-aw-bot · 2026-08-25T17:05:57Z

gh-aw-pr-sous-chef
@copilot PR Sous Chef triage: this PR still needs a forward-progress pass before maintainer investigation is likely to be productive.

Please do one focused follow-up pass:

address the blocking review about malformed allowed-repos input widening to the default all scope
refresh the branch if needed
use the pr-finisher skill before handing back for review

Run: https://github.com/github/gh-aw/actions/runs/32874927562

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 31.4 AIC · ⌖ 8.24 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

done

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-25T17:24:01Z

gh-aw-pr-sous-chef
@copilot PR Sous Chef triage: this PR still needs a forward-progress pass before maintainer investigation is likely to be productive.
...

Addressed in ad17985. Malformed scalar and mixed-array repository scopes now return contextual parse errors through ParseToolsConfig and guard-policy validation, preventing fallback to all.

gh-aw-bot · 2026-08-25T19:57:06Z

gh-aw-pr-sous-chef
@copilot PR Sous Chef triage: this PR still needs a forward-progress pass before maintainer investigation is likely to be productive.

Please do one focused follow-up pass:

unresolved review threads still remain; reply in-thread and resolve the remaining items, newest first:
- Give GitHubReposScope a concrete type #55793 (comment)
- Give GitHubReposScope a concrete type #55793 (comment)
failed checks: none currently, but the PR still needs the blocking review context fully addressed in-thread
refresh the branch if needed and use the pr-finisher skill before handing back for review

Run: https://github.com/github/gh-aw/actions/runs/32891822013

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.12 AIC · ⌖ 8.12 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Initial plan

6076924

Copilot AI assigned Copilot and pelikhan Aug 25, 2026

Copilot AI linked an issue Aug 25, 2026 that may be closed by this pull request

[deep-report] Give GitHubReposScope a real type instead of bare any #55770

Closed

Copilot started work on behalf of pelikhan August 25, 2026 14:00 View session

Type GitHub repository scopes

45f5c81

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Give GitHubReposScope a real type instead of bare any~~ Give GitHubReposScope a concrete type Aug 25, 2026

Copilot finished work on behalf of pelikhan August 25, 2026 14:16

Copilot AI requested a review from pelikhan August 25, 2026 14:16

pelikhan marked this pull request as ready for review August 25, 2026 16:21

Copilot AI balanced review requested due to automatic review settings August 25, 2026 16:21

Copilot started reviewing on behalf of pelikhan August 25, 2026 16:21 View session

Copilot AI reviewed Aug 25, 2026

View reviewed changes

github-actions Bot previously requested changes Aug 25, 2026

View reviewed changes

github-actions Bot mentioned this pull request Aug 25, 2026

[pr-sous-chef] PR Sous Chef run report #55546

Closed

Merge branch 'main' into copilot/deep-report-give-githubreposscope-type

b74167c

Copilot started work on behalf of gh-aw-bot August 25, 2026 17:06 View session

Plan malformed scope validation follow-up

939bb91

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Reject malformed GitHub repository scopes

ad17985

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 25, 2026 17:24

Copilot AI requested a review from gh-aw-bot August 25, 2026 17:24

github-actions Bot mentioned this pull request Aug 25, 2026

[PR Triage Report] PR triage report: no eligible Copilot PRs due to cooldown #55842

Closed

Copilot started work on behalf of gh-aw-bot August 25, 2026 19:57 View session

Plan follow-up review fixes

cbfac83

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan merged commit a5432dc into main Aug 25, 2026

Copilot stopped work on behalf of gh-aw-bot due to an error August 25, 2026 20:13
The session was cancelled by the user.

Navigation Menu

Uh oh!

Give GitHubReposScope a concrete type - #55793

Give GitHubReposScope a concrete type#55793
pelikhan merged 6 commits into
mainfrom
copilot/deep-report-give-githubreposscope-type

Copilot AI commented Aug 25, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Aug 25, 2026

Uh oh!

Copilot AI Aug 25, 2026

Uh oh!

gh-aw-bot commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

gh-aw-bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Aug 25, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 25, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

github-actions Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

gh-aw-bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 25, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 25, 2026 •

edited

Loading