Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot review the plan and continue implementation where it was not finished. |
|
@copilot mark all these safe outputs as experimental |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot ensure appropriate level of logging. Run custom linters for extra code quality. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Marked all six Azure DevOps safe outputs experimental in compiler warnings, schemas, tool descriptions, documentation, and the changeset, with focused warning tests in commit |
|
@copilot Mark, update all safe-outputs names and prepend |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Added debug-level Azure API lifecycle logs, standardized staged preview logging, and removed work-item titles and attachment paths from logs in |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Prefixed all Azure DevOps safe-output names in |
|
🧠 Matt Pocock Skills Reviewer failed during the skills-based review. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details.
|
|
✅ PR Code Quality Reviewer completed the code quality review. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"
- "proxy.golang.org"See Network Configuration for more information.
|
|
❌ Test Quality Sentinel failed during test quality analysis. Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details.
|
|
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes
The Azure DevOps safe-output plumbing still has blocking contract mismatches that will break callers as soon as these tools are used.
Blocking themes
- Several new handlers disagree on argument names between the advertised tool schema, the queueing layer, and the executor, so valid tool calls are transformed into malformed safe-output entries.
- The workflow schema narrows some
targetshapes below what the runtime explicitly supports, which will reject documented configurations at compile time.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.com
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 48.6 AIC · ⌖ 7.51 AIC · ⊞ 23.5K
Comment /review to run again
Comments that could not be inline-anchored
pkg/parser/schemas/main_workflow_schema.json:1476
The workflow schema rejects valid targets for ado-update-work-item and ado-assign-work-item: the runtime accepts an area-path string for updates and an ID list for assignments, but main_workflow_schema.json narrows those configs to "*" or a single integer.
<details><summary>💡 Compile-time schema needs to cover every runtime-supported target form</summary>
enforceTarget and the docs explicitly support area-path strings, and comment/link tools already reuse `azure_devops_work_item_ta…
actions/setup/js/safe_outputs_tools.json:1836
The JSON schemas and runtime disagree on ado_upload_workitem_attachment: the tool definition omits staged_file, but both the validator and agent-output.json require it, so the agent can never emit a payload that passes the write-side contract.
<details><summary>💡 The advertised input shape has to match the persisted safe-output shape</summary>
safe_outputs_tools.json exposes only work_item_id, file_path, and optional comment, but ValidationConfig and `UploadWorkItemAttachment…
actions/setup/js/safe_outputs_handlers.test.cjs:1025
The public ado_comment_on_work_item and ado_assign_work_item schemas require work_item_id, but the queueing tests and handlers still send id; that drops the identifier before execution and makes same-run temporary IDs unusable for two of the new tools.
<details><summary>💡 Keep one identifier contract end to end</summary>
The executor reads message.work_item_id, while safe_outputs_handlers.test.cjs exercises commentOnWorkItemHandler({ id: "#item", ... }) and `assignWorkItemHandl…
ADR RequiredThis PR adds a new architectural capability: Azure DevOps work-item mutations as first-class safe outputs ( I generated a draft ADR on this branch:
Evidence used:
Next action:
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"
- "proxy.golang.org"See Network Configuration for more information.
|
There was a problem hiding this comment.
A couple of small abstraction layers in the new Azure DevOps safe-output helper can be cut back without changing behavior; net: -18 lines possible.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
ab.chatgpt.com
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
Generated by ✂️ Ponytail Reviewer for #57796 · codex · mai10 · 8.37 AIC · ⌖ 0.443 AIC · ⊞ 13.5K
Comment /ponytail to run again
| } | ||
| } | ||
|
|
||
| const HANDLERS = { |
There was a problem hiding this comment.
actions/setup/js/azure_devops_work_items.cjs:515-528: yagni: generic dispatch table for six Azure DevOps actions. Export the concrete handlers directly and skip the wrapper until there is a real second consumer.
| }); | ||
| } | ||
|
|
||
| function validateAllowedTags(tags, allowedTags) { |
There was a problem hiding this comment.
actions/setup/js/azure_devops_work_items.cjs:64-82: yagni: tag/path allowlist helpers are tiny policy shims with one call site each. Inline the checks in the create/update branches and let the module stay focused on the API work.
There was a problem hiding this comment.
🟡 Changes recommended
Attachment scoping, artifact staging, schema inconsistencies, and JSON Patch operations can cause unauthorized or failed mutations.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds experimental Azure DevOps work-item mutations to the safe-output pipeline, including policy enforcement, temporary IDs, and attachment staging.
Changes:
- Adds six Azure DevOps work-item tools and trusted REST handlers.
- Extends schemas, compiler wiring, validation, and documentation.
- Adds temporary-ID, artifact-staging, and handler tests.
File summaries
| File | Description |
|---|---|
schemas/agent-output.json |
Adds Azure DevOps output schemas. |
pkg/workflow/tool_description_enhancer.go |
Registers tool constraints. |
pkg/workflow/safe_outputs_validation_config.go |
Defines output validation rules. |
pkg/workflow/safe_outputs_tools_computation.go |
Enables configured tools. |
pkg/workflow/safe_outputs_state.go |
Detects enabled Azure outputs. |
pkg/workflow/safe_outputs_max_validation.go |
Validates operation limits. |
pkg/workflow/safe_outputs_handler_registry.go |
Registers Azure handlers. |
pkg/workflow/safe_outputs_handler_registry_test.go |
Tests handler registration. |
pkg/workflow/safe_outputs_config_types.go |
Adds frontmatter configuration fields. |
pkg/workflow/safe_outputs_config_extraction.go |
Extracts Azure configuration. |
pkg/workflow/safe_outputs_azure_devops.go |
Implements compiler-side Azure configuration. |
pkg/workflow/safe_outputs_azure_devops_test.go |
Tests configuration generation. |
pkg/workflow/safe_output_validation_config_test.go |
Extends validation consistency tests. |
pkg/workflow/safe_output_handlers.go |
Describes Azure handler mappings. |
pkg/workflow/publish_artifacts.go |
Enables attachment artifact transfer. |
pkg/workflow/js/safe_outputs_tools.json |
Defines compiler tool schemas. |
pkg/workflow/compiler_validators.go |
Emits experimental warnings. |
pkg/workflow/compiler_safe_outputs_job.go |
Integrates handlers and downloads. |
pkg/workflow/azure_devops_experimental_warning_test.go |
Tests warning emission. |
pkg/parser/schemas/main_workflow_schema.json |
Defines frontmatter schemas. |
docs/src/content/docs/reference/safe-outputs.md |
Documents Azure outputs. |
actions/setup/js/upload_workitem_attachment.cjs |
Wraps attachment handling. |
actions/setup/js/update_work_item.cjs |
Wraps update handling. |
actions/setup/js/temporary_id.test.cjs |
Tests Azure temporary references. |
actions/setup/js/temporary_id.cjs |
Recognizes Azure ID fields. |
actions/setup/js/safe_outputs_tools.json |
Defines runtime tool schemas. |
actions/setup/js/safe_outputs_tools_loader.test.cjs |
Tests handler attachment. |
actions/setup/js/safe_outputs_tools_loader.cjs |
Loads normalized Azure tools. |
actions/setup/js/safe_outputs_handlers.test.cjs |
Tests proposal collection. |
actions/setup/js/safe_outputs_handlers.cjs |
Collects and stages proposals. |
actions/setup/js/safe_output_handler_manager.cjs |
Dispatches handlers and IDs. |
actions/setup/js/mcp_server_core.cjs |
Preserves public tool names. |
actions/setup/js/link_work_items.cjs |
Wraps link handling. |
actions/setup/js/generate_safe_outputs_tools.test.cjs |
Tests tool-name preservation. |
actions/setup/js/generate_safe_outputs_tools.cjs |
Normalizes enabled tools. |
actions/setup/js/create_work_item.cjs |
Wraps creation handling. |
actions/setup/js/comment_on_work_item.cjs |
Wraps comment handling. |
actions/setup/js/azure_devops_work_items.test.cjs |
Tests Azure REST policies. |
actions/setup/js/azure_devops_work_items.cjs |
Implements trusted REST operations. |
actions/setup/js/assign_work_item.cjs |
Wraps assignment handling. |
.changeset/minor-azure-devops-work-item-safe-outputs.md |
Records the minor feature. |
Review details
Suppressed comments (2)
actions/setup/js/azure_devops_work_items.cjs:360
- The multiline-format member may not exist yet, so JSON Patch
replacecan reject the otherwise valid body update. Useadd, which creates the member or replaces its current value.
patch.push({ op: "replace", path: "/multilineFieldsFormat/System.Description", value: "Markdown" });
actions/setup/js/azure_devops_work_items.cjs:402
- A previously unassigned work item commonly has no
System.AssignedTomember, making thisreplaceoperation fail. Use JSON Patchadd, which also updates the value when the member already exists.
await adoRequest(ado, "PATCH", `/_apis/wit/workitems/${resolved.id}?api-version=7.0`, [fieldPatch("replace", "System.AssignedTo", assignee)], "application/json-patch+json");
- Files reviewed: 42/42 changed files
- Comments generated: 7
- Review effort level: Balanced
| const resolved = resolveWorkItemReference(message.work_item_id, resolvedTemporaryIds, preview); | ||
| if (preview) return staged(`Would attach a file to Azure DevOps work item ${message.work_item_id}`); | ||
| const { bytes, filename } = readStagedAttachment(message, config); | ||
| const ado = getAzureDevOpsContext(); | ||
| const upload = await adoRequest(ado, "POST", `/_apis/wit/attachments?fileName=${encodeURIComponent(filename)}&api-version=7.1`, bytes, "application/octet-stream"); |
| } | ||
| const patch = requested.map(([name, field]) => { | ||
| const value = name === "tags" ? message.tags.join("; ") : message[name]; | ||
| return fieldPatch("replace", field, value); |
|
|
||
| const uploadWorkItemAttachmentHandler = args => { | ||
| const entry = { ...(args || {}), type: "ado_upload_workitem_attachment" }; | ||
| const rawPath = typeof entry.file_path === "string" ? entry.file_path.trim() : ""; |
| const stagingRoot = path.join(process.env.RUNNER_TEMP || "/tmp", "gh-aw", "safeoutputs", "upload-artifacts"); | ||
| const stagingDirectory = path.join(stagingRoot, "azure-devops-work-items"); | ||
| fs.mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 }); | ||
| const stagedName = `${crypto.randomUUID()}-${path.basename(rawPath)}`; |
| "target": { | ||
| "oneOf": [{ "type": "integer", "minimum": 1 }, { "const": "*" }] | ||
| }, |
| func usesSafeOutputsArtifactStaging(config *SafeOutputsConfig) bool { | ||
| return config != nil && (config.UploadArtifact != nil || config.UploadWorkItemAttachments != nil) |
| } | ||
|
|
||
| func parseAzureDevOpsConfig[T any](c *Compiler, outputMap map[string]any, key string, defaultMax int, postProcess func(*T)) *T { | ||
| if enabled, ok := outputMap[key].(bool); ok { |
|
@copilot run pr-finisher skill |
|
@copilot Please take another pass on this PR: refresh the branch with the latest base, address any outstanding review or CI follow-up, and then continue with the Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
Adds Azure DevOps work-item operations to the safe-output pipeline using the tool names defined by
ado-aw.Changes
Safe-output tools
create-work-item,update-work-item,comment-on-work-item,assign-work-item,link-work-items, andupload-workitem-attachment.Azure DevOps integration
actions/github-script.SYSTEM_ACCESSTOKENorAZURE_DEVOPS_EXT_PAT.Policy enforcement
Artifact handling
Run: https://github.com/github/gh-aw/actions/runs/33581675739
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.