Conversation
security-guard token usage with pre-run relevance gating, lower turn cap, and leaner prompt context
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
Smoke Test Results:
Status: PASS
|
🔥 Smoke Test: Copilot BYOK (Offline) Mode
Running in BYOK offline mode ( Overall: PASS — PR by
|
🔬 Smoke Test Results
Overall: FAIL (pre-step outputs missing — template substitution did not occur) PR by
|
Smoke Test Results
2/3 checks passed. Redis connectivity could not be verified due to missing tooling.
|
🏗️ Build Test Suite Results
Overall: 0/8 ecosystems passed — ❌ FAIL Error DetailsBun: C++: Deno: .NET: Go: Java: Node.js: Rust: The sandbox environment hit OS thread limits (
|
There was a problem hiding this comment.
Pull request overview
Optimizes the security-guard agent workflow to reduce unnecessary Claude token spend by skipping runs on PRs without security-relevant changes, lowering the max turn budget, and shrinking prompt/context payload.
Changes:
- Added a PR file-diff–based relevance gate (
check_security_relevance) and used it to skip the agent job when no security-critical files changed. - Reduced Claude max turns from 10 → 6 and updated the compiled lock workflow to match.
- Condensed security guidance in the prompt and trimmed high-volume sections from
CLAUDE.md.
Show a summary per file
| File | Description |
|---|---|
CLAUDE.md |
Removes large, non-security-focused guidance sections to reduce system context size for the security workflow. |
.github/workflows/security-guard.md |
Adds security relevance gating job + workflow-level gate, lowers max-turns, and compresses the “Security Checks” prompt content. |
.github/workflows/security-guard.lock.yml |
Updates compiled workflow to include the new gating job/needs/if logic and max-turns=6 runtime settings. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/security-guard.md:89
SECURITY_RE(and the PR-files API call) is duplicated here and in the newcheck_security_relevancejob. This increases maintenance risk (regex drift) and adds an extra API call per run. Consider reusingneeds.check_security_relevance.outputs.security_files_changedfor reporting in the prompt/summary, or centralizing the regex in one place so both checks stay consistent.
run: |
SECURITY_RE="host-iptables|setup-iptables|squid-config|docker-manager|seccomp-profile|domain-patterns|entrypoint\.sh|Dockerfile|(^|/)containers/"
COUNT=$(gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}/files" \
--paginate --jq '.[].filename' \
| grep -cE "$SECURITY_RE" || true)
echo "security_files_changed=$COUNT" >> "$GITHUB_OUTPUT"
- Files reviewed: 3/3 changed files
- Comments generated: 1
| SECURITY_RE="host-iptables|setup-iptables|squid-config|docker-manager|seccomp-profile|domain-patterns|entrypoint\.sh|Dockerfile|(^|/)containers/" | ||
| COUNT=$(gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}/files" \ | ||
| --paginate --jq '.[].filename' \ | ||
| | grep -cE "$SECURITY_RE" || true) | ||
| echo "count=$COUNT" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
The relevance gate currently treats any gh api failure as COUNT=0 (because the pipeline yields no lines and grep -c returns 0), which would skip the agent job and potentially miss a required security review. Please detect GitHub API errors explicitly (e.g., capture filenames first and check exit status / enable set -o pipefail) and default to a safe value that still runs the agent when the file list cannot be retrieved.
|
@copilot update the PR with this feedback #2113 (review) |
…lower turn cap, and leaner prompt context (#2113) * Initial plan * feat: optimize security-guard token usage and gating Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/fa62b406-4f98-4c20-9901-392bfda30bfa * fix: refine security relevance gating regex and non-pr fallback Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/fa62b406-4f98-4c20-9901-392bfda30bfa --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
…lower turn cap, and leaner prompt context (#2113) * Initial plan * feat: optimize security-guard token usage and gating Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/fa62b406-4f98-4c20-9901-392bfda30bfa * fix: refine security relevance gating regex and non-pr fallback Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/fa62b406-4f98-4c20-9901-392bfda30bfa --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
security-guardwas spending full Claude runs on PRs with no security-relevant changes, and carrying unnecessary prompt/context token overhead. This PR reduces avoidable token cost by skipping irrelevant runs, capping turns, and compressing high-volume guidance.Workflow-level relevance gating (skip non-security PRs)
check_security_relevancejob insecurity-guard.md.if: needs.check_security_relevance.outputs.security_files_changed != '0'security-guard.lock.yml(agent.needs,agent.if, and downstream needs updates).Lower Claude turn budget
engine.max-turnsfrom10to6in source workflow.--max-turnsandGH_AW_MAX_TURNS) to match.Prompt footprint reduction
Security Checkssection insecurity-guard.mdfrom multiple verbose subsections into a compact checklist of critical risk classes.System-context trimming for security workflow efficiency
CLAUDE.md/AGENTS.mdthat were identified as irrelevant to security-review execution context.Pattern precision hardening
containers/to(^|/)containers/to avoid accidental path overmatching.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/repos/actions/github-script/git/ref/tags/v9/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha 0 -j ACCEPT(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq .object.sha(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv /tmp/go-build2519296211/b315/symabis -c=4 -nolocalimports -importcfg /tmp/go-build2519296211/b315/importcfg -pack -asmhdr(http block)https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.68.3/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.68.3 --jq .object.sha 0 -j ACCEPT(http block)/usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.68.3 --jq .object.sha(http block)If you need me to access, download, or install something from one of these locations, you can either: