[Contribution Check Report] Contribution Check — 2026-04-09

[github-actions]

We looked at 6 open PRs — 4 look great and are ready for review, 2 need a bit more work before merge.

---

Ready to review 🟢

PR	Title	Author	Lines	Quality
#25403	fix: replace hardcoded github.token with configurable push token	@Copilot	993	lgtm ✨
#25402	fix: safe-outputs types from imports dropped	@Copilot	380	lgtm ✨
#25399	fix: don't exclude COPILOT_GITHUB_TOKEN from AWF container	@Copilot	255	lgtm ✨
#25072	Pin all MCP container images to SHA-256 digests	@Copilot	1816	lgtm ✨

---

Needs a closer look 🟡

PR	Title	Author	Lines	Quality
#25387	Remove CodeMirror dependency from live editor	@Copilot	455	needs-work
#25414	Normalize report headers from h2 to h3	@Copilot	15	needs-work

#25387 is missing Playwright tests for the rewritten editor's interactive behaviour (Tab indentation, localStorage, Mod-Enter compile, hover tooltips). Feedback posted to the PR.

#25414 is a markdown-only change — needs-work is mechanical (no testable code). Still in draft; minor scope note about an extra <details> block posted to the PR.

---

Evaluated: 6 · Skipped: 0 · Run: 24167318391

Generated by Contribution Check · ● 2.6M · ◷

• expires on Apr 10, 2026, 1:29 AM UTC

[github-actions]

We looked at 3 open non-draft PRs — 1 looks great and 2 need a closer look.

Note: The pre-filter step (pr-filter-results.json) was not found in the workspace; evaluated all open non-draft PRs directly.

---

Ready to review 🟢

PR	Title	Author	Lines	Quality
#25072	Pin all MCP container images to SHA-256 digests	@Copilot	1,816	lgtm ✨

---

Needs a closer look 🟡

PR	Title	Author	Lines	Quality
#25399	fix: don't exclude COPILOT_GITHUB_TOKEN from AWF container...	@Copilot	4,194	needs-work
#25431	chore: update drain3 default log pattern weights	@github-actions[bot]	1,457	needs-work

#25399 — PR bundles at least two distinct changes (the COPILOT_GITHUB_TOKEN env-var bug fix and an undescribed compiler_difc_proxy.go feature addition), plus a mass lock-file version bump. Only the env-var fix is described in the body. Consider splitting or updating the description.

#25431 — Automated weights-refresh PR with no test coverage for the updated JSON data file. Expected for a data-only PR, but a lightweight validity smoke test would be a useful follow-up.

---

Evaluated: 3 · Skipped: n/a · Run: 24174105592

Generated by Contribution Check · ● 2.2M · ◷

• expires on Apr 10, 2026, 5:38 AM UTC

[github-actions]

We looked at 3 recent PRs — 1 looks great and is ready for review, and 2 need a closer look before merging.

---

Ready to review 🟢

PR	Title	Author	Lines	Quality
#25434	[ca] Update Claude Code 2.1.94→2.1.97 and Gemini CLI 0.36.0→0.37.0	@Copilot	424	lgtm ✨

---

Needs a closer look 🟡

PR	Title	Author	Lines	Quality
#25435	[code-simplifier] refactor: extract resolveProxyContainerImage helper	@github-actions[bot]	28	needs-work
#25433	docs: add workflow_run triggers, external API integration, Playwright	@Copilot	197	needs-work

#25435 is a clean, focused refactor — it just needs a dedicated unit test for the new resolveProxyContainerImage helper before graduating from draft.

#25433 bundles three independent documentation topics (workflow_run triggers, Playwright network config, external API integration) into a single PR. Splitting it into three focused PRs would make each change independently reviewable and mergeable.

---

Evaluated: 3 · Skipped: 0 · Run: 24182404570

Generated by Contribution Check · ● 1.7M · ◷

• expires on Apr 10, 2026, 9:24 AM UTC

[github-actions]

Contribution Check Report

Field	Value
PR	#25473 — [WIP] Fix invalid discussions permission in safe-outputs jobs
Author	Copilot (copilot-swe-agent)
Verdict	🟢 Aligned
Quality	needs-work
On-topic	✅ yes
Follows process	✅ yes
Focused	✅ yes
New deps	✅ no
Has tests	❌ no (WIP — only an "Initial plan" commit, 0 lines changed)
Has description	✅ yes (very thorough)
Diff size	0 lines
Existing labels	(none)

---

Checklist Reasoning

On-topic — ✅ yes

Fixes a real compiler bug: discussions: write and permission-discussions: write are unconditionally emitted for all add-comment safe-output jobs — even when no discussion-targeted outputs are configured — causing GitHub Apps token minting to fail with HTTP 422. Directly within the project's accepted scope.

Follows process — ✅ yes

Created by the copilot-swe-agent bot (inner-circle coding agent), assigned to pelikhan (core team). Triggered by community issue #25467 with a thorough agentic plan. Process followed correctly.

Focused — ✅ yes

Addresses a single, well-scoped bug: remove unconditional discussions: write from add-comment permission computation when no discussion-related safe outputs are configured.

New deps — ✅ no

No code has been committed yet (initial plan only).

Has tests — ❌ no

The PR is in draft/WIP state and the sole commit (2b27a12 — "Initial plan") contains zero file changes. Tests in pkg/workflow/safe_outputs_permissions_test.go will need to cover the new conditional behaviour once the implementation lands.

---

Affected Area (from codebase research)

The bug traces through two key files:

1. pkg/workflow/add_comment.go — buildAddCommentPermissions
   The function currently uses an opt-out model: discussions: write is included by default (when config.Discussions is nil) even when the user never targets a discussion. The fix should flip to opt-in: only add discussions: write when config.Discussion (singular) is true or when config.Discussions (plural) is explicitly true.

2. pkg/workflow/safe_outputs_app_config.go
   The PermissionDiscussions → "permission-discussions" mapping passes an invalid input key to create-github-app-token. discussions is not a valid GitHub Apps permission scope; the correct scope is team_discussions (for team discussions) or it should simply not be passed when it was inherited from an add-comment-only workflow.

Related open issue: #19380 (same symptom, GitHub App token rejection). Closed precedent: #16500 (partial fix, same class of bug — add-comment and hide-comment unconditionally requesting discussions: write).

---

Suggested comment posted to PR

Hey @Copilot 👋 — thanks for picking up issue #25467! The plan is well-structured and the affected area is correctly identified. A few things to keep in mind as the implementation lands:

• buildAddCommentPermissions in add_comment.go — flip from opt-out to opt-in for discussions: write: only include it when config.Discussion == true (user is posting to a discussion target) or config.Discussions == true (user explicitly opted in). Omitting discussions in an add-comment-only workflow should produce zero discussion permissions.
• safe_outputs_app_config.go — permission-discussions is not a valid GitHub Apps API input; guard this mapping behind the same conditional, or omit it entirely for add-comment-only configs.
• Tests — pkg/workflow/safe_outputs_permissions_test.go has the right patterns; add a case for add-comment with no discussions field (should emit no discussions: write) and one for add-comment with discussions: false (same). Also add a safe_outputs_app test asserting permission-discussions is absent when no discussion outputs are configured.
• Golden-file update — run make agent-finish after the fix; several .lock.yml golden fixtures will need regeneration.

Generated by Contribution Check · ● 2.2M · ◷

• expires on Apr 10, 2026, 1:40 PM UTC

[github-actions]

Contribution Check — 2026-04-09

No PR filter results were available for this run. The pr-filter-results.json file was not found in the workspace, which indicates the pre-agent filtering step did not complete successfully or produced no output.

No PRs were evaluated in this run.

---

Evaluated: 0 · Skipped: 0 · Run: 24203452004

Generated by Contribution Check · ● 207.5K · ◷

• expires on Apr 10, 2026, 5:18 PM UTC