fix: remove lockdown from issue-monster workflow, add security screening, switch to codex engine, and merge main#17122
Closed
fix: remove lockdown from issue-monster workflow, add security screening, switch to codex engine, and merge main#17122
Conversation
The Issue Monster workflow was failing because lockdown: true requires a custom GitHub token (GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, or custom github-token) but none are configured in this repo. Removes lockdown: true and recompiles the lock file. Fixes: https://github.com/github/gh-aw/actions/runs/22207821070 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Debug workflow failure for Issue Monster
fix: remove lockdown from issue-monster workflow
Feb 20, 2026
Contributor
|
@copilot update the prompt to ignore any issue that has a suspicious request, malicious intent, or other harmful or unsecured behaviors |
Adds a security screening step (step 4a) that instructs the agent to skip any issue containing prompt injections, malicious code requests, credential harvesting, supply chain attack patterns, social engineering, or other harmful content before assigning to Copilot. Also updates the guidelines and success criteria to reflect the new security check, and recompiles the lock file. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Added a security screening step (4a) in commit 243e9d1 that instructs the agent to skip any issue containing:
When flagged, the agent reports it via |
Copilot
AI
changed the title
fix: remove lockdown from issue-monster workflow
fix: remove lockdown from issue-monster workflow and add security screening
Feb 20, 2026
pelikhan
approved these changes
Feb 20, 2026
Contributor
|
@copilot use codex |
Contributor
There was a problem hiding this comment.
Pull request overview
Adjusts the Issue Monster agentic workflow to avoid failing on lockdown validation in repos without custom GitHub tokens, while adding explicit guidance to skip suspicious/harmful issues before assignment.
Changes:
- Removed
tools.github.lockdown: truefrom the Issue Monster workflow prompt to rely on default token behavior. - Added a “Security Screening” step instructing the agent to skip issues containing prompt injection, malicious requests, secret harvesting, supply-chain manipulation, etc.
- Recompiled the locked workflow to remove explicit lockdown validation and set
GITHUB_LOCKDOWN_MODEbased on automatic lockdown detection output.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/issue-monster.md | Removes forced lockdown mode and adds pre-assignment security screening guidance for issue selection. |
| .github/workflows/issue-monster.lock.yml | Removes explicit lockdown validation/injection and wires automatic lockdown detection into MCP server config. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Copilot
AI
changed the title
fix: remove lockdown from issue-monster workflow and add security screening
fix: remove lockdown from issue-monster workflow, add security screening, and switch to codex engine
Feb 20, 2026
Contributor
|
@copilot merge main and recompile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit 20200ba — merged origin/main, rebuilt the binary, and recompiled all 153 workflow lock files. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
fix: remove lockdown from issue-monster workflow, add security screening, and switch to codex engine
fix: remove lockdown from issue-monster workflow, add security screening, switch to codex engine, and merge main
Feb 20, 2026
Contributor
|
@copilot merge main and recompile |
Contributor
Author
The branch is already up to date with Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
lockdown: truefromissue-monster.mdtools.github configurationcopilot(gpt-5.1-codex-mini) tocodexOriginal prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.