Conversation
50 tasks
This comment has been minimized.
This comment has been minimized.
Contributor
|
Hey
|
…on.md component - Create shared/daily-audit-discussion.md with import-schema for title-prefix and expires - Fix parseUploadAssetConfig to treat upload-asset: false as disabled - Migrate 40 workflows to use the shared component - Remove repetitive create-discussion/close-discussion blocks from each workflow Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e41372a2-fbe3-468e-b5a9-f52bb0cc4b40 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Refactor to extract daily audit discussion configuration
refactor: extract daily audit discussion configuration into shared/daily-audit-discussion.md
Apr 2, 2026
pelikhan
reviewed
Apr 2, 2026
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/32ec29e9-ae78-409d-ad50-9ca5d5842a27 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
pelikhan
approved these changes
Apr 2, 2026
Collaborator
|
@copilot merge main and recompile |
…ed-daily-audit-component # Conflicts: # .github/workflows/audit-workflows.lock.yml # .github/workflows/audit-workflows.md # .github/workflows/copilot-agent-analysis.lock.yml # .github/workflows/copilot-agent-analysis.md # .github/workflows/copilot-pr-nlp-analysis.lock.yml # .github/workflows/copilot-pr-nlp-analysis.md # .github/workflows/copilot-pr-prompt-analysis.lock.yml # .github/workflows/copilot-pr-prompt-analysis.md # .github/workflows/copilot-session-insights.lock.yml # .github/workflows/copilot-session-insights.md # .github/workflows/daily-copilot-token-report.lock.yml # .github/workflows/daily-copilot-token-report.md # .github/workflows/delight.lock.yml # .github/workflows/delight.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 899162f. Merged main, resolved 7 .md conflicts by taking both Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR centralizes the repeated create-discussion safe-outputs configuration into a shared workflow import and migrates many workflows to use it, while also fixing upload-asset: false handling in the workflow compiler.
Changes:
- Added a reusable shared component (
shared/daily-audit-discussion.md) with animport-schemato standardizecreate-discussionsafe-outputs configuration. - Migrated multiple workflows from inline
create-discussionsafe-outputs blocks to the shared import (and updated corresponding.lock.ymloutputs). - Fixed
parseUploadAssetConfigsoupload-asset: falseexplicitly disables upload-asset instead of enabling defaults.
Reviewed changes
Copilot reviewed 82 out of 82 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/publish_assets.go | Treats upload-asset: false as an explicit disable signal. |
| .github/workflows/shared/daily-audit-discussion.md | Introduces shared, parameterized create-discussion safe-outputs config. |
| .github/workflows/weekly-issue-summary.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/weekly-issue-summary.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/typist.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/typist.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/terminal-stylist.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/terminal-stylist.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/sergo.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/schema-consistency-checker.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/safe-output-health.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/repository-quality-improver.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/repo-audit-analyzer.md | Adds shared import while retaining workflow-specific safe-outputs config. |
| .github/workflows/repo-audit-analyzer.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/prompt-clustering-analysis.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/portfolio-analyst.md | Adds shared import while retaining upload-asset safe-outputs config. |
| .github/workflows/portfolio-analyst.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/mcp-inspector.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/lockfile-stats.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/go-fan.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/github-remote-mcp-auth-test.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/github-mcp-tools-report.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/github-mcp-tools-report.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/github-mcp-structural-analysis.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/example-workflow-analyzer.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/example-workflow-analyzer.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/docs-noob-tester.md | Adds shared import while retaining upload-asset safe-outputs config. |
| .github/workflows/docs-noob-tester.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/developer-docs-consolidator.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/developer-docs-consolidator.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/delight.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/delight.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/daily-team-evolution-insights.md | Replaces inline discussion safe-outputs with shared import. |
| .github/workflows/daily-team-evolution-insights.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/daily-secrets-analysis.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/daily-secrets-analysis.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/daily-regulatory.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/daily-performance-summary.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/daily-performance-summary.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/daily-observability-report.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/daily-issues-report.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/daily-integrity-analysis.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/daily-firewall-report.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/daily-firewall-report.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/daily-copilot-token-report.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/daily-compiler-quality.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/daily-code-metrics.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/copilot-session-insights.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/copilot-pr-prompt-analysis.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/copilot-pr-nlp-analysis.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/copilot-pr-merged-report.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/copilot-agent-analysis.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/claude-code-user-docs-review.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/blog-auditor.md | Migrates to shared import, removing inline discussion tool config. |
| .github/workflows/blog-auditor.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/audit-workflows.md | Migrates to shared import, retaining upload-asset safe-outputs config. |
| .github/workflows/audit-workflows.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
| .github/workflows/agentic-observability-kit.md | Migrates to shared import alongside existing escalation safe-outputs. |
| .github/workflows/agentic-observability-kit.lock.yml | Regenerated lockfile reflecting shared import and other compiled-job graph changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+24
to
+28
| // Explicit false disables upload-asset (e.g. when passed via import-inputs) | ||
| if b, ok := configData.(bool); ok && !b { | ||
| publishAssetsLog.Print("upload-asset explicitly set to false, skipping") | ||
| return nil | ||
| } |
There was a problem hiding this comment.
The new upload-asset: false disablement path isn’t covered by the existing unit tests for parseUploadAssetConfig. Please add/extend a test case that passes {"upload-asset": false} and asserts the result is nil (and that true still enables defaults), to prevent regressions in this behavior change.
Comment on lines
915
to
917
| await main(); | ||
|
|
||
| detection: | ||
| needs: agent | ||
| if: > | ||
| always() && needs.agent.result != 'skipped' && (needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true') | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }} | ||
| detection_success: ${{ steps.detection_conclusion.outputs.success }} | ||
| steps: | ||
| - name: Checkout actions folder | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| repository: github/gh-aw | ||
| sparse-checkout: | | ||
| actions | ||
| persist-credentials: false | ||
| - name: Setup Scripts | ||
| uses: ./actions/setup | ||
| with: | ||
| destination: ${{ runner.temp }}/gh-aw/actions | ||
| - name: Download agent output artifact | ||
| id: download-agent-output | ||
| continue-on-error: true | ||
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | ||
| with: | ||
| name: agent | ||
| path: /tmp/gh-aw/ | ||
| - name: Setup agent output environment variable | ||
| id: setup-agent-output-env | ||
| if: steps.download-agent-output.outcome == 'success' | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/ | ||
| find "/tmp/gh-aw/" -type f -print | ||
| echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" | ||
| - name: Checkout repository for patch context | ||
| if: needs.agent.outputs.has_patch == 'true' | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| persist-credentials: false | ||
| # --- Threat Detection --- | ||
| - name: Download container images | ||
| run: bash ${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.25.10 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.10 ghcr.io/github/gh-aw-firewall/squid:0.25.10 | ||
| - name: Check if detection needed | ||
| id: detection_guard | ||
| if: always() | ||
| env: | ||
| OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} | ||
| HAS_PATCH: ${{ needs.agent.outputs.has_patch }} | ||
| run: | | ||
| if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then | ||
| echo "run_detection=true" >> "$GITHUB_OUTPUT" | ||
| echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH" | ||
| else | ||
| echo "run_detection=false" >> "$GITHUB_OUTPUT" | ||
| echo "Detection skipped: no agent outputs or patches to analyze" | ||
| fi | ||
| - name: Clear MCP configuration for detection | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| run: | | ||
| rm -f /tmp/gh-aw/mcp-config/mcp-servers.json | ||
| rm -f /home/runner/.copilot/mcp-config.json | ||
| rm -f "$GITHUB_WORKSPACE/.gemini/settings.json" | ||
| - name: Prepare threat detection files | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/threat-detection/aw-prompts | ||
| cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true | ||
| cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true | ||
| for f in /tmp/gh-aw/aw-*.patch; do | ||
| [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true | ||
| done | ||
| for f in /tmp/gh-aw/aw-*.bundle; do | ||
| [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true | ||
| done | ||
| echo "Prepared threat detection files:" | ||
| ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true | ||
| - name: Setup threat detection | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| env: | ||
| WORKFLOW_NAME: "Weekly Issue Summary" | ||
| WORKFLOW_DESCRIPTION: "Creates weekly summary of issue activity including trends, charts, and insights every Monday" | ||
| HAS_PATCH: ${{ needs.agent.outputs.has_patch }} | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs'); | ||
| await main(); | ||
| - name: Ensure threat-detection directory and log | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| run: | | ||
| mkdir -p /tmp/gh-aw/threat-detection | ||
| touch /tmp/gh-aw/threat-detection/detection.log | ||
| - name: Install GitHub Copilot CLI | ||
| run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest | ||
| - name: Install AWF binary | ||
| run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.10 | ||
| - name: Execute GitHub Copilot CLI | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| id: detection_agentic_execution | ||
| # Copilot CLI tool arguments (sorted): | ||
| timeout-minutes: 20 | ||
| run: | | ||
| set -o pipefail | ||
| touch /tmp/gh-aw/agent-step-summary.md | ||
| # shellcheck disable=SC1003 | ||
| sudo -E awf --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" --env-all --exclude-env COPILOT_GITHUB_TOKEN --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,github.com,host.docker.internal,telemetry.enterprise.githubcopilot.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --image-tag 0.25.10 --skip-pull --enable-api-proxy \ | ||
| -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-all-tools --add-dir "${GITHUB_WORKSPACE}" --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log | ||
| env: | ||
| COPILOT_AGENT_RUNNER_TYPE: STANDALONE | ||
| COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| COPILOT_MODEL: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }} | ||
| GH_AW_PHASE: detection | ||
| GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt | ||
| GH_AW_VERSION: dev | ||
| GITHUB_API_URL: ${{ github.api_url }} | ||
| GITHUB_AW: true | ||
| GITHUB_HEAD_REF: ${{ github.head_ref }} | ||
| GITHUB_REF_NAME: ${{ github.ref_name }} | ||
| GITHUB_SERVER_URL: ${{ github.server_url }} | ||
| GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md | ||
| GITHUB_WORKSPACE: ${{ github.workspace }} | ||
| GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com | ||
| GIT_AUTHOR_NAME: github-actions[bot] | ||
| GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com | ||
| GIT_COMMITTER_NAME: github-actions[bot] | ||
| XDG_CONFIG_HOME: /home/runner | ||
| - name: Upload threat detection log | ||
| if: always() && steps.detection_guard.outputs.run_detection == 'true' | ||
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 | ||
| with: | ||
| name: detection | ||
| path: /tmp/gh-aw/threat-detection/detection.log | ||
| if-no-files-found: ignore | ||
| - name: Parse and conclude threat detection | ||
| id: detection_conclusion | ||
| if: always() | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| env: | ||
| RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }} | ||
| with: | ||
| script: | | ||
| const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs'); | ||
| setupGlobals(core, github, context, exec, io); | ||
| const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs'); | ||
| await main(); | ||
|
|
||
| safe_outputs: |
There was a problem hiding this comment.
This regenerated lockfile removes the separate detection (and related downstream dependencies) and changes safe_outputs to no longer depend on detection (needs: agent only). That’s a significant behavioral/security/operational change beyond the PR description’s safe-outputs refactor; please confirm it’s intended and either document it in the PR description or split it into a dedicated change.
Comment on lines
19
to
+22
| imports: | ||
| - uses: shared/daily-audit-discussion.md | ||
| with: | ||
| title-prefix: "[daily secrets] " |
There was a problem hiding this comment.
This workflow’s instructions require close_discussion and state the discussion expires after 3 days, but after migrating to the shared import: (1) safe-outputs.close-discussion is no longer configured, and (2) with.expires is not provided, so the resolved config currently falls back to the tool default (seen as expires: 168 in the lockfile). Re-add safe-outputs.close-discussion and either pass expires: 3d here or ensure the shared import reliably applies its 3d default.
Comment on lines
19
to
+23
| timeout-minutes: 30 | ||
| imports: | ||
| - uses: shared/daily-audit-discussion.md | ||
| with: | ||
| title-prefix: "[daily issues] " |
There was a problem hiding this comment.
The workflow instructions require closing prior discussions via close_discussion, but the close-discussion safe-outputs config was removed during the migration to the shared discussion import. Also, with.expires is omitted here (previously 3d), so retention may change unless the shared import default is reliably applied. Please re-add safe-outputs.close-discussion and consider passing expires: 3d explicitly (or fix the shared default behavior).
Suggested change
| timeout-minutes: 30 | |
| imports: | |
| - uses: shared/daily-audit-discussion.md | |
| with: | |
| title-prefix: "[daily issues] " | |
| timeout-minutes: 30 | |
| safe-outputs: | |
| - close-discussion | |
| imports: | |
| - uses: shared/daily-audit-discussion.md | |
| with: | |
| title-prefix: "[daily issues] " | |
| expires: 3d |
Comment on lines
21
to
25
| imports: | ||
| - uses: shared/daily-audit-discussion.md | ||
| with: | ||
| title-prefix: "[daily regulatory] " | ||
| - shared/github-queries-mcp-script.md |
There was a problem hiding this comment.
The workflow body instructs the agent to use close_discussion, but the close-discussion safe-outputs config was removed when migrating to the shared discussion import. Also, with.expires is omitted here (previously 3d), so retention may change unless the shared import default is reliably applied. Please re-add safe-outputs.close-discussion and consider passing expires: 3d explicitly (or fix the shared default behavior).
Comment on lines
+17
to
+21
| expires: | ||
| type: string | ||
| default: "3d" | ||
| description: "How long to keep discussions before expiry (e.g. 1d, 3d, 7d)" | ||
|
|
There was a problem hiding this comment.
The expires input is marked optional with default: "3d", but workflows that omit with.expires are still resolving to the tool default expiry (e.g. expires: 168 in .github/workflows/daily-secrets-analysis.lock.yml). This suggests import-schema.default isn’t being applied to github.aw.import-inputs.expires; consider using an explicit expression fallback (or make expires required) so the intended 3d default is reliably enforced.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
44 workflows each manually repeated 8–10 lines of identical
create-discussionsafe-outputs config, with no single source of truth for audit discussion hygiene settings (expiry, category, max, close-older).Changes
New shared component:
shared/daily-audit-discussion.mdParametrized shared import with
import-schemafortitle-prefix(required) andexpires(optional, default3d). Provides a standardizedcreate-discussionsafe-outputs block.40 workflow migrations
Replaced inline
create-discussionandclose-discussionblocks with the import above. Three workflows from the issue list were intentionally skipped:issue-arborist.mdandpoem-bot.md(nosafe-outputs), anddeep-report.md(category: "reports"rather than"audits").Workflows that needed
upload-assetretain it in their ownsafe-outputsor receive it transitively viapython-dataviz.md; the shared component deliberately omitsupload-assetto avoid safe-outputs type conflicts when multiple imports provide it.Bug fix:
parseUploadAssetConfigupload-asset: falsewas previously treated identically toupload-asset: null(both enabled the feature with defaults). Nowfalseexplicitly disables it.Result
~350–400 lines removed across the codebase. All 179 workflows compile (0 errors).