Conversation
…workflow_call context
In workflow_call-compiled lock files, the conclusion job was downloading the
agent artifact with an unprefixed name ('agent') while the upload step used
the per-invocation prefix ('${{ needs.activation.outputs.artifact_prefix }}agent').
This mismatch caused the download to miss, leaving GH_AW_AGENT_OUTPUT unset
and breaking downstream safe-output processing.
Fix: pass artifactPrefixExprForDownstreamJob(data) to buildAgentOutputDownloadSteps
in buildConclusionJob, buildGitHubScriptStep, and buildCustomActionStep.
Also adds two new tests:
- TestConclusionJobWorkflowCallArtifactPrefix: verifies prefixed artifact name in workflow_call context
- TestConclusionJobNonWorkflowCallNoArtifactPrefix: verifies no prefix in non-workflow_call context
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
March 15, 2026 01:40
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes artifact download naming in workflow_call compiled workflows by ensuring downstream jobs use the same artifact name prefix as the upload step, preventing missing downloads and broken safe-output handlers.
Changes:
- Pass the workflow-call artifact prefix into the conclusion job’s agent artifact download step.
- Apply the same prefix to agent artifact downloads in safe-output step builders.
- Add tests to validate prefixed vs unprefixed behavior, and recompile workflow-call smoke lock workflows.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/notify_comment.go | Conclusion job now downloads the agent artifact using the workflow-call prefix expression. |
| pkg/workflow/safe_outputs_jobs.go | Safe-output step builders now pass an artifact prefix expression into agent artifact downloads. |
| pkg/workflow/notify_comment_test.go | Adds tests asserting prefixed download name for workflow_call and no prefix for non-workflow_call. |
| .github/workflows/smoke-workflow-call.lock.yml | Recompiled lockfile reflects prefixed agent artifact download name in conclusion job. |
| .github/workflows/smoke-workflow-call-with-inputs.lock.yml | Same as above for the “with inputs” smoke workflow lockfile. |
Comments suppressed due to low confidence (1)
pkg/workflow/safe_outputs_jobs.go:193
artifactPrefixExprForDownstreamJob(data)expands toneeds.activation.outputs.artifact_prefixinworkflow_callworkflows, but safe-output jobs that use this step builder (e.g.upload_assetsbuilt inpublish_assets.go) only declareneeds: [agent]and do not includeactivation. That makes the generated workflow invalid at runtime when the expression is evaluated. UseartifactPrefixExprForAgentDownstreamJob(data)here (since these jobs already depend on the agent job and the agent propagatesartifact_prefix), or ensure the job'sneedsalways includesactivationwhenworkflow_callis enabled.
// Add artifact download steps before the custom action step.
// In workflow_call context, use the per-invocation prefix to avoid artifact name clashes.
steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForDownstreamJob(data))...)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Contributor
|
@copilot review comments |
…d buildCustomActionStep buildSafeOutputJob-based jobs (e.g. upload_assets) only depend on the agent job, not the activation job. Using needs.activation.outputs.artifact_prefix in those jobs would break workflow_call workflows since activation is not in their needs. Use artifactPrefixExprForAgentDownstreamJob (needs.agent.outputs.artifact_prefix) in buildGitHubScriptStep and buildCustomActionStep instead. Also adds two tests verifying the correct prefix expression is used per context. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 5f16465. Changed Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In
workflow_callcompiled workflows, downstream jobs were downloading the agent artifact using the unprefixed nameagentwhile the upload step correctly used${{ needs.activation.outputs.artifact_prefix }}agent. This caused downloads to miss, leavingGH_AW_AGENT_OUTPUTunset and breaking downstream safe-output processing (noop, missing-tool, agent-failure handlers).Changes
notify_comment.go—buildConclusionJobnow passesartifactPrefixExprForDownstreamJob(data)(needs.activation.outputs.artifact_prefix) tobuildAgentOutputDownloadSteps. The conclusion job always hasactivationin itsneeds, so this expression is valid.safe_outputs_jobs.go—buildCustomActionStepandbuildGitHubScriptStepnow passartifactPrefixExprForAgentDownstreamJob(data)(needs.agent.outputs.artifact_prefix) tobuildAgentOutputDownloadSteps. Jobs built viabuildSafeOutputJob(e.g.upload_assets) only declareneeds: [agent], notactivation, so the agent-downstream expression must be used.notify_comment_test.go— Two new tests asserting the prefixed name is used inworkflow_callcontext and no prefix is added for regular triggers.safe_output_helpers_test.go— Two new tests assertingbuildGitHubScriptStepusesneeds.agent.outputs.artifact_prefixinworkflow_callcontext and no prefix otherwise.smoke-workflow-call.lock.yml— Recompiled; conclusion job and script step downloads now correctly emit the prefixed artifact name.The fix aligns all download code paths with what
buildConsolidatedSafeOutputsJobalready did correctly, using the appropriate prefix expression for each job's dependency graph.📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.