Upgrade gh-aw v0.48.1 → v0.49.0, template safe-output max fields#376
Upgrade gh-aw v0.48.1 → v0.49.0, template safe-output max fields#376
Conversation
- Bump GH_AW_VERSION to v0.49.0 (security hardening + templatable fields) - Template create-issue.max in Plan workflow via new create-issue-max input - Template create-pull-request-review-comment.max in fragment via new input - Template resolve-pull-request-review-thread.max in fragment via new input - Add corresponding inputs to all importing workflows - Regenerate all lock files with make compile Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>
📝 WalkthroughWalkthroughUpgrade gh-aw to v0.49.0 across workflows and lockfiles: updated setup action pins, bumped agent/tool/image versions, refactored prompt-file assembly, added workflow inputs/outputs (matched_command, code_push_failure_count, code_push_failure_errors), and extended safe-outputs configuration and propagation. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| safe-outputs: | ||
| resolve-pull-request-review-thread: | ||
| max: 10 | ||
| max: ${{ inputs.resolve-pull-request-review-thread-max }} |
There was a problem hiding this comment.
[LOW] Limitation text no longer matches configurable max
This fragment now makes max configurable via $\{\{ inputs.resolve-pull-request-review-thread-max }}, but the prose below still states a fixed limit of 10 per run. That can mislead reviewers when a caller overrides the default.
Consider wording this as "default is 10" (or referencing the input) so the instructions stay accurate when customized.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/gh-aw-fragments/safe-output-resolve-thread.md:
- Around line 3-4: Update the docs so the "max-per-run" limitation reflects the
configurable input instead of hardcoding 10: change any text in the limitations
section that states "max 10" to reference the input name
resolve-pull-request-review-thread-max and note its default is 10 (e.g.,
"configurable via inputs.resolve-pull-request-review-thread-max, default 10") so
it aligns with the workflow key resolve-pull-request-review-thread and the max
setting max: ${{ inputs.resolve-pull-request-review-thread-max }}.
In @.github/workflows/gh-aw-test-improvement.lock.yml:
- Line 1575: The GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG JSON currently contains
"draft":"${{ inputs.draft-prs }}" which produces a string; update the
safe-output-create-pr.md template so the draft property emits an unquoted
boolean (e.g., draft: ${{ inputs.draft-prs }} or render true/false directly) so
the compiled GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG has draft as a JSON boolean
inside the create_pull_request object; then re-run the compilation step (gh aw
compile) to regenerate the workflows and verify
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG contains draft:false or draft:true (not
quoted).
| env: | ||
| GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} | ||
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}" | ||
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"draft\":\"${{ inputs.draft-prs }}\",\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find the source .md file corresponding to gh-aw-test-improvement.lock.yml
fd -e md -path "*/workflows/*" | grep -i "test-improvement"Repository: elastic/ai-github-actions
Length of output: 237
🏁 Script executed:
# Search for GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in .md files
rg "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG" -A 3 -B 3 --type markdownRepository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Also check all .md files in the workflows directory
find .github/workflows -name "*.md" -type fRepository: elastic/ai-github-actions
Length of output: 3389
🏁 Script executed:
# Search for GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in all markdown files
rg "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG" -A 2 -B 2Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Also check which .md file corresponds to gh-aw-test-improvement.lock.yml
# List both the potential source and check the lock file timestamp
ls -la .github/workflows/gh-aw-test-improve*.* 2>/dev/null | head -20Repository: elastic/ai-github-actions
Length of output: 356
🏁 Script executed:
# Search for GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in the source .md file
cat -n .github/workflows/gh-aw-test-improver.md | grep -A 5 -B 5 "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG"Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Also check if there's a gh-aw-test-improvement.md file (exact name match)
cat .github/workflows/gh-aw-test-improvement.md 2>&1 | head -5Repository: elastic/ai-github-actions
Length of output: 144
🏁 Script executed:
# Check the content at line 1575 in the target lock file
sed -n '1570,1580p' .github/workflows/gh-aw-test-improvement.lock.ymlRepository: elastic/ai-github-actions
Length of output: 801
🏁 Script executed:
# Search for GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in gh-aw-test-improver.md
rg "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG" .github/workflows/gh-aw-test-improver.md -A 3 -B 3Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Search more broadly in all .md files for the draft configuration
rg "draft.*inputs\.draft-prs" .github/workflows/Repository: elastic/ai-github-actions
Length of output: 4204
🏁 Script executed:
# Check which .md files reference create_pull_request config
rg "create_pull_request" .github/workflows/ -lRepository: elastic/ai-github-actions
Length of output: 1922
🏁 Script executed:
# Look at the safe-output-create-pr.md fragment since that's likely where the config is defined
cat .github/workflows/gh-aw-fragments/safe-output-create-pr.mdRepository: elastic/ai-github-actions
Length of output: 2240
🏁 Script executed:
# Check how the safe-output-create-pr.md fragment is included in the source files that generate lock files
rg "safe-output-create-pr" .github/workflows/*.mdRepository: elastic/ai-github-actions
Length of output: 1232
🏁 Script executed:
# Look at the gh-aw-test-improver.md to see how it uses the safe-output-create-pr fragment
cat -n .github/workflows/gh-aw-test-improver.md | head -100Repository: elastic/ai-github-actions
Length of output: 3862
🏁 Script executed:
# Find where the handler code is and check what it expects for the draft field
find . -name "*handler*" -o -name "*safe*output*" | grep -v ".lock.yml" | grep -v node_modulesRepository: elastic/ai-github-actions
Length of output: 625
🏁 Script executed:
# Check the full gh-aw-test-improver.md to see if there's any safe-outputs configuration section
cat .github/workflows/gh-aw-test-improver.md | grep -A 20 "safe-outputs:"Repository: elastic/ai-github-actions
Length of output: 540
🏁 Script executed:
# Check the safe outputs validation rules
cat ./scripts/gh-aw-safe-outputs-validation-rules.mdRepository: elastic/ai-github-actions
Length of output: 11335
🏁 Script executed:
# Search for where GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG is constructed or how the compilation happens
rg "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG" -B 5 -A 5 .github/workflows/gh-aw-test-improver.mdRepository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Look for any compilation or build scripts
find . -name "*.json" -o -name "*.js" -o -name "*.py" | grep -E "(compile|build|transform)" | head -10Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Look at the safe-output-create-pr.md fragment more carefully
cat -n .github/workflows/gh-aw-fragments/safe-output-create-pr.mdRepository: elastic/ai-github-actions
Length of output: 2457
🏁 Script executed:
# Search for any documentation or code about how gh aw compile handles the config
rg "gh aw compile" -A 5 -B 5Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Check if there's a README or docs about the workflow compilation
cat README.md 2>/dev/null | head -200Repository: elastic/ai-github-actions
Length of output: 2062
🏁 Script executed:
# Check if there are any comments or examples in the safe-output-create-pr.md about JSON structure or special syntax
cat .github/workflows/gh-aw-fragments/safe-output-create-pr.md | grep -i "json\|template\|boolean\|syntax" -B 2 -A 2Repository: elastic/ai-github-actions
Length of output: 965
🏁 Script executed:
# Look at other safe-output fragments to see how they handle config values
ls -la .github/workflows/gh-aw-fragments/safe-output-*.md | head -5Repository: elastic/ai-github-actions
Length of output: 619
🏁 Script executed:
# Check the actual handler code in the compiled lock file to understand if it uses draft as a boolean or string
sed -n '1575,1700p' .github/workflows/gh-aw-test-improvement.lock.yml | grep -A 50 "Process Safe Outputs"Repository: elastic/ai-github-actions
Length of output: 51
🏁 Script executed:
# Look at the actual handler code in the gh-aw repository or documentation
# First, let's check what the handler does with the draft field by looking at references in the repo
rg "draft" .github/workflows/gh-aw-fragments/safe-output-create-pr.md -B 5 -A 5Repository: elastic/ai-github-actions
Length of output: 619
🏁 Script executed:
# Let's see how the github-script action receives and parses the GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG
sed -n '1560,1650p' .github/workflows/gh-aw-test-improvement.lock.ymlRepository: elastic/ai-github-actions
Length of output: 1826
🏁 Script executed:
# Check if there are other places in the codebase that show how the config is parsed
rg "GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG" -A 20 | head -80Repository: elastic/ai-github-actions
Length of output: 51
Fix the draft field to emit as a JSON boolean instead of a string
The draft field in .github/workflows/gh-aw-fragments/safe-output-create-pr.md is quoted inside the JSON config, producing "draft":"true" or "draft":"false" strings. If the handler expects a boolean, string "false" evaluates as truthy in JavaScript, forcing draft PRs or causing validation errors. Remove the quotes around the variable so it compiles to a boolean:
Fix (apply in safe-output-create-pr.md)
- draft: ${{ inputs.draft-prs }}
+ draft: ${{ inputs.draft-prs }}Actually, the issue is in how the compiled config embeds this. The source .md shows draft: ${{ inputs.draft-prs }} unquoted, but during compilation into the JSON string for GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG, it becomes quoted. Update the source to emit the boolean directly in the JSON:
- GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"draft\":\"${{ inputs.draft-prs }}\",\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}"
+ GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"draft\":${{ inputs.draft-prs }},\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}"This affects multiple workflows. Update the source .md template and re-run gh aw compile.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"draft\":\"${{ inputs.draft-prs }}\",\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}" | |
| GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_pull_request\":{\"base_branch\":\"${{ github.base_ref || github.ref_name }}\",\"draft\":${{ inputs.draft-prs }},\"max\":1,\"max_patch_size\":1024},\"missing_data\":{},\"missing_tool\":{}}" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/gh-aw-test-improvement.lock.yml at line 1575, The
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG JSON currently contains "draft":"${{
inputs.draft-prs }}" which produces a string; update the
safe-output-create-pr.md template so the draft property emits an unquoted
boolean (e.g., draft: ${{ inputs.draft-prs }} or render true/false directly) so
the compiled GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG has draft as a JSON boolean
inside the create_pull_request object; then re-run the compilation step (gh aw
compile) to regenerate the workflows and verify
GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG contains draft:false or draft:true (not
quoted).
Use ${{ inputs.resolve-pull-request-review-thread-max }} in the
prose limitation text so the LLM sees the actual configured value
at runtime instead of a hardcoded "10".
Also includes uncommitted trigger-ci-workflows.sh updates for
new workflow names.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Requesting changes: the monitor workflow names in scripts/trigger-ci-workflows.sh should use the exact workflow names so dispatch works reliably.
What is this? | From workflow: PR Review
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
| MONITORS=( | ||
| "Trigger Agent Efficiency" | ||
| "Agent Deep Dive" | ||
| "Agent Efficiency" |
There was a problem hiding this comment.
[MEDIUM] Monitor workflow names do not match actual workflow names
The monitor list now uses "Agent Deep Dive" and "Agent Efficiency", but the actual workflow names are "Internal: Agent Deep Dive" and "Internal: Agent Efficiency" (see .github/workflows/agent-deep-dive.lock.yml and .github/workflows/agent-efficiency.lock.yml). gh workflow run matches by exact name/ID/filename, so these entries will fail to dispatch.
| "Agent Efficiency" | |
| "Internal: Agent Deep Dive" | |
| "Internal: Agent Efficiency" |
Upgrades
gh-awfromv0.48.1tov0.49.0and wires templated safe-outputmaxinputs where runtime configurability is needed.What changed
gh-aw version + generated workflow refresh
GH_AW_VERSIONinMakefiletov0.49.0..github/workflows/agentics-maintenance.ymlto usegithub/gh-aw/actions/setup@v0.49.0..github/aw/actions-lock.jsonwith the new setup action pin.v0.49.0compiler output, including thepre_activation.outputs.matched_commandwiring alignment across regenerated.lock.ymlworkflows.Templated safe-output max inputs
Added workflow-call inputs and wired them into safe-output config:
create-issue.maxcreate-issue-max5.github/workflows/gh-aw-plan.mdcreate-pull-request-review-comment.maxcreate-pull-request-review-comment-max30.github/workflows/gh-aw-pr-review.md,.github/workflows/gh-aw-docs-pr-review.md,.github/workflows/gh-aw-mention-in-pr.md,.github/workflows/gh-aw-mention-in-pr-no-sandbox.md, and.github/workflows/gh-aw-fragments/safe-output-review-comment.mdresolve-pull-request-review-thread.maxresolve-pull-request-review-thread-max10.github/workflows/gh-aw-mention-in-pr.md,.github/workflows/gh-aw-mention-in-pr-no-sandbox.md, and.github/workflows/gh-aw-fragments/safe-output-resolve-thread.mddraft-prsremains driven by the existing input wiring.CI trigger script alignment
Updated
scripts/trigger-ci-workflows.shmonitor workflow names by addingAgent Deep Diveand renamingTrigger Agent EfficiencytoAgent Efficiency.Fixes [gh-aw-upgrade] gh-aw upgrade available: v0.48.1 → v0.49.0 #371