Skip to content

refactor: extract shared PR code review base configuration#22492

Merged
pelikhan merged 2 commits intomainfrom
copilot/refactor-pr-review-config
Mar 23, 2026
Merged

refactor: extract shared PR code review base configuration#22492
pelikhan merged 2 commits intomainfrom
copilot/refactor-pr-review-config

Conversation

Copy link
Contributor

Copilot AI commented Mar 23, 2026

Seven workflows inline the same PR review tooling pattern — cache-memory, GitHub PR toolsets, create-pull-request-review-comment with side: "RIGHT", and submit-pull-request-review: max: 1. This creates drift risk and repetition across review agents.

Changes

  • New shared component.github/workflows/shared/pr-code-review-config.md provides:

    tools:
      cache-memory: true
      github:
        toolsets: [pull_requests, repos]
    safe-outputs:
      create-pull-request-review-comment:
        side: "RIGHT"
      submit-pull-request-review:
        max: 1
  • grumpy-reviewer.md — imports shared component; retains github: min-integrity: approved and max: 5 (merged with imported toolsets via recursive map merge)

  • pr-nitpick-reviewer.md — imports shared component alongside existing shared/reporting.md; retains max: 10 and create-discussion config

  • security-review.md — imports shared component; retains github: toolsets: [all] (merged to all,pull_requests,repos — functionally equivalent); removes now-redundant cache-memory and submit-pull-request-review

Behavior notes

  • Safe-output type overrides are whole-block: if a workflow defines create-pull-request-review-comment, it fully supersedes the imported block. The side: "RIGHT" default is also the Go struct default, so omitting it from per-workflow overrides is safe.
  • Tools merge recursively — github: min-integrity: approved in the main workflow correctly combines with github: toolsets: [pull_requests, repos] from the import.
  • Smoke tests (smoke-copilot, smoke-copilot-arm, smoke-claude) unaffected and verified compiling.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ,short (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ler_orchestrator--norc to_pull_request_--noprofile ateway_entrypoint_mounts_e2e_test.go _val�� t_masking.go cripts_generator.go (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build695711889/b237/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/text@v0.35.0/feature/plural/common.go /hom�� --check scripts/**/*.js 64/bin/go .prettierignore 64/pkg/tool/linu-o 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --write **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-json sh -c "prettier" --wriGOINSECURE git 64/bin/go rror /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/prettier /usr/bin/git go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse 0/x64/bin/npm ithub/workflows config DiscussionsEnabl-unreachable=false git -C json' --ignore-path ../../../.pr**/*.json config /usr/bin/gh remote.origin.ur/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rev-parse /usr/bin/gh /usr/bin/gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.urgit rev-parse $name) { has6ec8a5c34f0597bafe08d4d3e225700956c2d22f:.github/workflows/pr-nitpick-reviewer.mcapi-prod-claude-sonnet-4.5 x_amd64/vet api */*.ts' '**/*.json' --ignore-path ../../../.prettierignore -f x_amd64/vet l owner=github -f x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-persona-explorer.md x_amd64/asm /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel tDxh6_4/9rUbv3kNVNgnGPLEQds7 /usr/bin/gh -json r/common.go x_amd64/compile gh (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha sistency_GoAndJavaScript2610069025/001/test-complex-frontmatter-with-tools.md -trimpath /usr/bin/git -p github.com/segmerev-parse -lang=go1.17 git rev-�� --show-toplevel -dwarf=false /usr/bin/git go1.25.0 -c=4 -nolocalimports git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha _.a oding@v0.5.4/json/codec.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu--json env _.a PZlisUvcs 64/pkg/tool/linu--limit GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha GOMODCACHE x_amd64/compile /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git archie.md rg/x/text@v0.35.rev-parse ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile n-dir/node 711889/b240/_pkggit Py4f/fabLKooQ2qrrev-parse 711889/b240=> git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha k/gh-aw/gh-aw/.github/workflows config x_amd64/vet l docker ed } } x_amd64/vet 0/x6�� k/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.ur/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/asm rev-parse DiscussionsEnabled } } x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha k/gh-aw/gh-aw/.github/workflows iginal x_amd64/vet ithub/workflows rev-parse $name) { has6ec8a5c34f0597bafe08d4d3e225700956c2d22f:.github/workflows/pr-nitpick-reviewer.lock.yml x_amd64/vet api */*.ts' '**/*.json' --ignore-path ../../../.prettierignore -f x_amd64/vet -f owner=github -f x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha k/gh-aw/gh-aw/.github/workflows rev-parse x_amd64/vet l -f /usr/bin/gh x_amd64/vet --ve�� y-reviewer.lock.yml /usr/bin/gh x_amd64/vet ithub/workflows -f /usr/bin/git x_amd64/vet (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha k/gh-aw/gh-aw/.github/workflows rev-parse x_amd64/vet l "$k=".$v["localshow ed } } x_amd64/vet 0/x6�� xterm-color /usr/bin/gh x_amd64/vet ithub/workflows -f (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.urgit "$k=".$v["localshow DiscussionsEnabl6ec8a5c34f0597bafe08d4d3e225700956c2d22f:.github/workflows/pr-nitpick-reviewer.md x_amd64/vet -C */*.ts' '**/*.json' --ignore-path ../../../.prettierignore rev-parse x_amd64/vet xterm-color git me: String!) { --show-toplevel x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha graphql -f x_amd64/vet -f owner=github -f x_amd64/vet tion�� y-reviewer.lock.yml docker.io/mcp/brave-search x_amd64/vet ithub/workflows rev-parse r: $owner, name:--show-toplevel x_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha ithub/workflows rev-parse x_amd64/vet xterm-color infocmp /usr/bin/git x_amd64/vet 0/x6�� k/gh-aw/gh-aw/.github/workflows git x_amd64/vet l rev-parse DiscussionsEnabled } } x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3994015184/001/stability-test.md go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /opt/hostedtoolcache/node/24.14.0/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/n--show-toplevel GOINSECURE GOMOD GOMODCACHE node (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha ithub/workflows -f x_amd64/vet -f owner=github -f x_amd64/vet 0/x6�� --get-regexp ^remote\..*\.gh-resolved$ x_amd64/vet ithub/workflows rev-parse repository(owne-x x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/go-build4240346697/b444/_pkg_.a l /opt/hostedtoolcache/node/24.14.0/x64/bin/node -p github.com/githurev-parse -lang=go1.25 node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ace-editor.md -goversion /usr/bin/git -c=4 -nolocalimports -importcfg git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /home/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE node (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 4238-42674/test-3151319670 -trimpath /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -p unicode/utf8 -lang=go1.25 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build695711889/b167/_pkg_.a -trimpath 0/x64/bin/node -p crypto/md5 -lang=go1.25 0/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE tions/setup/js/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha get --local /home/REDACTED/.dotnet/tools/git copilot.originalgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha k/gh-aw/gh-aw/.github/workflows (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility ithub/workflows (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility --noprofile (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /tmp/go-build695711889/b087/_pkg_.a pkg/mod/github.com/goccy/go-yaml@v1.19.2/scanner/context.go 0346697/b306/vet.cfg -p crypto/internal/rev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build695711889/b103/_pkg_.a -trimpath ache/go/1.25.0/x64/pkg/tool/linux_amd64/link -p log/slog -lang=go1.25 ache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE ode GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha ithub/workflows/ace-editor.md pkg/mod/github.com/goccy/go-yaml@v1.19.2/internal/errors/error.go 0346697/b314/vet.cfg -I /tmp/go-build695rev-parse -I ortcfg -o g/timeutil/format.go g/timeutil/format_test.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -p flow-12345 -lang=go1.21 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE ules/.bin/node GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE ser.test GOINSECURE GOMOD GOMODCACHE ser.test (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/asm estl�� -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build4240346697/b436/_testmain.go env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE Vf/BhlgiPQLV7BtyLMk5D9X/OHWTsuY774h45AWzuVqe (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go N files are not /opt/hostedtoolcache/node/24.14.0/x64/bin/node GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/asm env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build695711889/b234/importcfg -embedcfg /tmp/go-build695711889/b234/embedcfg /hom�� --check scripts/**/*.js 64/bin/go -d 64/pkg/tool/linu-o 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 github.com/ayman-o -lang=go1.24 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE 248059e4 GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ty-test.md GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build4240346697/b445/_testmain.go env plorer.md GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --write scripts/**/*.js 64/bin/go .prettierignore --log-level=erro/opt/hostedtoolcache/node/24.14.0/x64/bin/npm 0/x64/lib/node_mrun sh -c "prettier" --wriGOSUMDB go 64/bin/go '**/*.ts' '**/*.node GO111MODULE ache/go/1.25.0/xprettier go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha /tmp/go-build314-p -trimpath 64/bin/go -p github.com/githu-atomic -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha /tmp/go-build314-p -trimpath 64/bin/go -p github.com/githu-atomic -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha /tmp/go-build314-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -m son/json.go 64/bin/go --write **/*.cjs 64/bin/go go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha /tmp/go-build314-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE Vf/BhlgiPQLV7BtyLMk5D9X/OHWTsuY7^remote\..*\.gh-resolved$ env mpiledOutput1052571979/001 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha prettier --write 64/bin/go --ignore-path .prettierignore --log-level=erronpx prettier --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json sh -c "prettier" --wriGOSUMDB pkg/workflow/docGOWORK 64/bin/go '**/*.ts' '**/*.node GO111MODULE ache/go/1.25.0/xprettier go (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 267676356/.github/workflows @v1.19.2/token/token.go 64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -nolocalimports -importcfg /tmp/go-build695711889/b138/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/oauth2@v0.34.0/deviceauth.go /hom�� --check scripts/**/*.js 64/bin/go -d 64/pkg/tool/linu-o 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -nolocalimports -importcfg /tmp/go-build695711889/b002/importcfg -embedcfg /tmp/go-build695711889/b002/embedcfg env GOPATH sh 64/bin/go -d 64/pkg/tool/linu-o 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.json --ignore-path ../../../.pretti-json sh -c "prettier" --wriGOINSECURE git 64/bin/go --show-toplevel /opt/hostedtoolc/opt/hostedtoolcache/node/24.14.0/x64/bin/npx /usr/bin/git go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build4240346697/b400/cli.test /tmp/go-build4240346697/b400/cli.test -test.testlogfile=/tmp/go-build4240346697/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build695711889/b203/importcfg -pack /hom�� --check **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti/tmp/go-build695711889/b206/_pkg_.a go (http block)
    • Triggering command: /tmp/go-build2247457256/b400/cli.test /tmp/go-build2247457256/b400/cli.test -test.testlogfile=/tmp/go-build2247457256/b400/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel /opt/hostedtoolcenv /usr/bin/git sh -c npx prettier --wGOINSECURE git 64/bin/go --show-toplevel /opt/hostedtoolc-c /usr/bin/git go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build695711889/b238/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/text@v0.35.0/internal/catmsg/catmsg.go -c "prettier" --che-p node 64/bin/go ced successfully/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile format:cjs 64/bin/go go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --write **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-json sh -c "prettier" --wriGOINSECURE git 64/bin/go rror /opt/hostedtoolc/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/prettier run-script/lib/n--check go (http block)

If you need me to access, download, or install something from one of these locations, you can either:


📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

Fixes #1551

- Create .github/workflows/shared/pr-code-review-config.md with shared config:
  cache-memory, github toolsets [pull_requests, repos], create-pull-request-review-comment
  side RIGHT, and submit-pull-request-review max 1
- Update grumpy-reviewer.md to import shared component, removing duplicate config
- Update pr-nitpick-reviewer.md similarly
- Update security-review.md similarly
- Regenerate lock files for all three workflows

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/98001808-6936-4837-9236-331ed885a406
Copilot AI changed the title [WIP] Refactor PR code review configuration into a shared component refactor: extract shared PR code review base configuration Mar 23, 2026
Copilot AI requested a review from pelikhan March 23, 2026 19:52
@pelikhan pelikhan marked this pull request as ready for review March 23, 2026 20:07
Copilot AI review requested due to automatic review settings March 23, 2026 20:07
@pelikhan pelikhan merged commit f750acf into main Mar 23, 2026
@pelikhan pelikhan deleted the copilot/refactor-pr-review-config branch March 23, 2026 20:08
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Refactors AI PR review workflows by extracting a shared base frontmatter configuration (tools + safe-outputs defaults) to reduce duplication and drift across review agents.

Changes:

  • Added a shared component defining cache-memory, GitHub toolsets, and default review safe-outputs.
  • Updated grumpy-reviewer, pr-nitpick-reviewer, and security-review workflows to import the shared config and remove redundant inline config.
  • Regenerated corresponding *.lock.yml manifests to include the new runtime import and merged GitHub toolsets.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
.github/workflows/shared/pr-code-review-config.md New shared base config + guidance for PR code review agents (tools + safe-outputs).
.github/workflows/security-review.md Imports shared config; removes redundant cache-memory / safe-output defaults.
.github/workflows/security-review.lock.yml Reflects import + merged toolsets in compiled manifest.
.github/workflows/pr-nitpick-reviewer.md Imports shared config; removes duplicated tool + safe-output defaults.
.github/workflows/pr-nitpick-reviewer.lock.yml Reflects new import in compiled manifest.
.github/workflows/grumpy-reviewer.md Imports shared config; removes duplicated tool + safe-output defaults while retaining guard policy.
.github/workflows/grumpy-reviewer.lock.yml Reflects new import in compiled manifest.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +30 to +32
1. **Check cache first** — Read `/tmp/gh-aw/cache-memory/pr-${{ github.event.issue.number }}.json` to avoid re-stating previous comments
2. **Use `get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `get_review_comments`** — Check existing review threads before adding new ones
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cache file path in these shared review guidelines hard-codes github.event.issue.number, which will be empty for workflows triggered by pull_request events (e.g., ready_for_review). This can lead to reading/writing pr-.json and losing the intended per-PR history. Use the same fallback pattern used elsewhere in this repo (e.g., ${{ github.event.issue.number || github.event.pull_request.number }}) for the cache filename.

Suggested change
1. **Check cache first** — Read `/tmp/gh-aw/cache-memory/pr-${{ github.event.issue.number }}.json` to avoid re-stating previous comments
2. **Use `get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `get_review_comments`** — Check existing review threads before adding new ones
1. **Check cache first** — Read `/tmp/gh-aw/cache-memory/pr-${{ github.event.issue.number || github.event.pull_request.number }}.json` to avoid re-stating previous comments
2. **Use `get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `get_review_comments` — Check existing review threads before adding new ones

Copilot uses AI. Check for mistakes.
Comment on lines +31 to +32
2. **Use `get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `get_review_comments`** — Check existing review threads before adding new ones
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

get_diff and get_review_comments are not standalone GitHub MCP tools in this repo; they’re methods on pull_request_read (see e.g. .github/workflows/dev-hawk.md and .github/workflows/copilot-agent-analysis.md). Consider rewording these bullets to explicitly instruct calling pull_request_read with method: get_diff / method: get_review_comments to avoid agents attempting to invoke non-existent tools.

Suggested change
2. **Use `get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `get_review_comments`** — Check existing review threads before adding new ones
2. **Use `pull_request_read` with `method: get_diff`** — Fetch the actual diff to review line-by-line changes
3. **Use `pull_request_read` with `method: get_review_comments`** — Check existing review threads before adding new ones

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[refactoring] Extract PR Code Review base configuration into shared component

3 participants