fix: resolve {{#import}} directives in workflow markdown body at compile and runtime; deprecate {{#import}} in favor of {{#runtime-import}}

[Copilot]

{{#import filepath}} directives placed directly in the workflow markdown body were recorded as "Includes" in the lock file manifest but their content was never injected into the agent prompt — the agent received the raw literal string instead.

Root cause: In normal (non-inline) mode, the compiled prompt references the original workflow file via {{#runtime-import .github/workflows/my-workflow.md}}. At runtime, runtime_import.cjs reads that file and handles nested {{#runtime-import}} macros recursively — but {{#import}} directives were not recognized and passed through as-is. Additionally, the compiled lock file gave no visibility into which body-level files would be imported.

Changes

actions/setup/js/runtime_import.cjs

• At the start of processRuntimeImports, normalize all {{#import}} variants to {{#runtime-import}} before the main processing loop (backward-compat shim for the now-deprecated syntax). Supports all syntax forms:

  {{#import filepath}}    {{#import? filepath}}
  {{#import: filepath}}   {{#import?: filepath}}
  

• Emits a core.warning deprecation notice when any {{#import}} directive is encountered.
• Updated the recursive detection check to also trigger on {{#import}} in imported file content, enabling proper resolution of nested body-level imports.

actions/setup/js/runtime_import.test.cjs

• 8 new tests covering: basic/optional/colon/optional-colon variants (all deprecated), missing optional file, required-but-missing file error, the primary bug scenario (body-level {{#import}} inside a file loaded via {{#runtime-import}}), and negative test ensuring {{#importantthing}} (no separator) is not matched.
• First test verifies the deprecation core.warning is emitted.

.github/shared/editorial.md (new)

• Added a shared prompt file instructing the agent to write in a newspaper editorial tone: lead with the most important finding, use active voice, keep sentences tight, and present data-driven observations as confident conclusions.

Daily agentic workflows

• Updated daily-news.md, daily-issues-report.md, and daily-team-status.md to use {{#runtime-import .github/shared/editorial.md}} (the recommended form) instead of the now-deprecated {{#import:}} syntax.

pkg/parser/import_directive.go

• All {{#import}} forms are now marked IsLegacy: true, making them deprecated alongside @include/@import.

pkg/parser/include_processor.go

• Updated deprecation warning message for {{#import}} directives to recommend {{#runtime-import}} for content injection or the imports: frontmatter field for configuration merging.

pkg/parser/include_expander.go

• Fixed the lock file Includes: header so that files in sibling .github/ subdirectories are recorded with a repo-root-relative path instead of an absolute system path.
• Added findGitHubRepoRoot helper that walks up from baseDir to the parent of .github/.
• Updated ExtractBodyLevelImportPaths to scan the markdown body for {{#runtime-import}} directives (the recommended form) instead of the deprecated {{#import}} directives. Only required (non-optional) non-URL file paths are promoted. Uses filepath.IsAbs() for cross-platform absolute-path detection.

pkg/workflow/compiler_orchestrator_tools.go

• Body-level {{#runtime-import}} directives are now promoted to explicit macros in the compiled lock file prompt — the same treatment as frontmatter imports: entries. Optional {{#runtime-import?}} directives are excluded from promotion to prevent them being emitted as required macros.

The compiled prompt for the daily workflows now shows:

{{#runtime-import .github/shared/editorial.md}}
{{#runtime-import .github/workflows/daily-team-status.md}}

pkg/workflow/manifest_test.go

• Added TestManifestIncludePathRelativeToRepoRoot to verify that files in sibling .github/ subdirectories are recorded with repo-root-relative paths (not absolute) in the lock file Includes: header.
• Updated TestBodyLevelRuntimeImportPromotedToMacro (previously TestBodyLevelImportPromotedToRuntimeImport) to use {{#runtime-import}} directly, verifying that body-level {{#runtime-import}} macros are promoted before the main workflow file macro in the compiled prompt.

Documentation

• docs/src/content/docs/reference/imports.md: Updated body-level imports section to show {{#runtime-import}} as the primary recommended syntax. Added a [!WARNING] callout documenting the {{#import}} deprecation and migration path.
• docs/src/content/docs/reference/templating.md: Updated comparison section to note that {{#import}} is deprecated and normalizes to {{#runtime-import}} at runtime for backward compatibility; removed the incorrect "No recursion" limitation.

[pelikhan]

@copilot

• create a .github/shared/editorial.md file that includes a short prompt to use a "newspaper editorial tone".
• use {{#import: ... }} to import this file in a few daily agentic workflows.

[Copilot]

@copilot

• create a .github/shared/editorial.md file that includes a short prompt to use a "newspaper editorial tone".
• use {{#import: ... }} to import this file in a few daily agentic workflows...

Done in commit 0eab0c4:

• Created .github/shared/editorial.md with a short newspaper editorial tone prompt (lead with the most important finding, active voice, tight sentences, confident conclusions)
• Added {{#import: .github/shared/editorial.md}} to daily-news.md, daily-issues-report.md, and daily-team-status.md

This also serves as a real-world test of the body-level {{#import}} fix — these workflows will now resolve and inject the editorial tone instructions at runtime.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot review the lock file with imports:

• the file names in the header should be relative
• the file content of editorial.md is not imported!

[Copilot]

@copilot review the lock file with imports:

• the file names in the header should be relative...

Fixed in commit 38459c8:

File names in header now relative: include_expander.go now falls back to a repo-root-relative path (by walking up to the parent of .github/) when the included file lives in a sibling directory like .github/shared/. The lock file now shows:

#   Includes:
#     - .github/shared/editorial.md
#     - shared/noop-reminder.md

Editorial content: The {{#import:}} directive in the workflow body is resolved at runtime by runtime_import.cjs (the core fix in this PR) — the content is injected in-place when the agent runs, at the exact position in the file. The Includes: header now correctly records the file with its repo-root-relative path so the association is clearly visible in the lock file.

Also added TestManifestIncludePathRelativeToRepoRoot to guard against regressions.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw piler_activation-1 piler_activationxterm-color piler_activation_jobs_test.go pile�� piler_artifacts_test.go piler_aw_context.go piler_benchmark_test.go piler_builtin_pr/usr/bin/gh piler_cache_testapi piler_compilatiographql piler_container_-f (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw piler_cache_testapi piler_compilatiographql piler_container_-f pile�� piler_customstep-f piler_difc_proxyowner=github ock.yml (http block)
• https://api.github.com/orgs/test-owner/actions/secrets
  • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build1523173842/b070/importcfg -pack /tmp/go-build1523173842/b070/_testmain.go tion�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD (http block)
  • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git --check **/*.cjs 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 3292310228 GO111MODULE ache/go/1.25.8/xinstall git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git LsRemoteWithRealgit LsRemoteWithRealrev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 01057962/001 GO111MODULE 64/pkg/tool/linuinstall git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows/ai-moderator.md rev-parse ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go git t-17�� k/gh-aw/gh-aw/.github/workflows/architecture-guardian.md go /usr/bin/git sm-opt -Oz (sizegit GO111MODULE 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/compile-all-instructions-test-3833384980/.github/workflows remote /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/architecture-guardian.md go /usr/bin/infocmp -json GO111MODULE 64/bin/go infocmp (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env 4057600436 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel -tests /usr/bin/git -json GO111MODULE ache/go/1.25.8/x: git rev-�� --show-toplevel go /usr/bin/git 5456-43545/test-git GO111MODULE .cfg git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x-tests /usr/bin/git -bool -buildtags /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git config /usr/bin/git git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260424-235456-43545/test-4128500305/.github/workflows rev-parse /usr/bin/git '**/*.ts' '**/*.git GO111MODULE ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 1 GO111MODULE 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv --objects l /usr/bin/git --exclude-hiddengit --all --quiet git -C runs/20260424-235903-67980/test-774483018 remote /usr/bin/git s/test.md GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git 4057600436 GO111MODULE 64/pkg/tool/linurun git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv kflowFiles_WithStagedFiles3079089673/001/workflow.md go /usr/bin/git heck '**/*.cjs' /usr/lib/git-core/git GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel go /usr/bin/infocmp ithub/workflows/git GO111MODULE /opt/hostedtoolc--show-toplevel infocmp (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK ache/go/1.25.8/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.GOINSECURE GO111MODULE ache/go/1.25.8/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv .js' --ignore-paGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv GOMODCACHE x_amd64/asm /usr/bin/git -json GO111MODULE 64/bin/go /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/gh prettier --check 64/bin/go gh (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260424-235456-43545/test-4128500305/.github/workflows rev-parse /usr/bin/git '**/*.ts' '**/*.git GO111MODULE ache/go/1.25.8/x--show-toplevel git -C /tmp/gh-aw-test-runs/20260424-235456-43545/test-3292310228 l /opt/hostedtoolcache/node/24.14.1/x64/bin/node remote.origin.urgit GO111MODULE 64/bin/go node (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/infocmp y-frontmatter.mdgit GO111MODULE 64/bin/go infocmp -1 xterm-color node /usr/bin/gh prettier --check 64/bin/go gh (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --symref (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv :latest -q /usr/bin/git -json GO111MODULE ache/go/1.25.8/x--show-toplevel git -C /tmp/TestGuardPolicyBlockedUsersCommaSeparatedCompiledOutput3299792478/001 config /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet remote.origin.urgit GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-add-gitattributes-test978260222 show ache/node/24.14.1/x64/bin/node -json GO111MODULE 64/bin/go ache/node/24.14.1/x64/bin/node s-13�� .actor }}, Unsafe: ${{ secrets.TOKEN }} go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv user.email ings.cjs odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/git cjs st/suppress-warn-o 64/bin/node forks.js rev-�� HEAD st/suppress-warnmain _modules/.bin/gi-lang=go1.25 HEAD -aw/aw-test-owne--experimental-import-meta-resolve k/gh-aw/gh-aw/ac--require st/dist/workers//home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv . tions/setup/js/node_modules/vite--stdout $name) { hasDiscussionsEnabled } } d git tions/setup/node-m git init�� -q (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch HEAD (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch user.email tions/setup/js/node_modules/viteowner=github 64/pkg/tool/linux_amd64/link ules/.bin/git git bin/git 64/pkg/tool/linuconfig bran�� -M t-patch-utils-hsXX5W/.diffsize.tmp repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } --is-ancestor k/gh-aw/gh-aw/ac-C es/.bin/git git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch ithub/workflows k/gh-aw/gh-aw/actions/setup/js/node_modules/vitest/suppress-warnings.cjs /opt/hostedtoolcache/node/24.14.1/x64/bin/node r/work/gh-aw/gh-git /home/REDACTED/wor-C run-script/lib/n/home/REDACTED/work/gh-aw/gh-aw k/gh-aw/gh-aw/acshow 4044�� ithub/workflows test-jHnl4X/error.go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link node --conditions ed } } /opt/hostedtoolcconfig (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv GOMODCACHE x_amd64/cgo /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel sh /usr/bin/git npx prettier --cgit GOPROXY 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv user.email test@example.com /usr/bin/git th .prettierignogit GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git 45/001/test-frongit GO111MODULE 86_64/sh git (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --pack_header=2,3 -q /usr/bin/git -json GO111MODULE tions/node_modul--show-toplevel git conf�� --get s/test.md /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv y --stdin /usr/bin/git --exclude-hiddengit --all --quiet git rev-�� --show-toplevel go /usr/bin/git 4100227546/001' 4100227546/001' 64/bin/go git (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv GOMODCACHE go /usr/bin/git -json GO111MODULE tions/setup/js/n--show-toplevel git conf�� runs/20260424-235456-43545/test-4057600436 Test User /usr/bin/git s/test.md GO111MODULE 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch2107883938/001' git-receive-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch2107883938/001' e/git -json GO111MODULE 64/bin/go e/git -C /tmp/gh-aw-test-runs/20260424-235903-67980/test-1793775912/.github/workflows rev-parse /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK run-script/lib/n/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/api-consumption-report.md go env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti--show-toplevel go env 1499566248 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE k/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env Onlyrepos_only_without_min-integrity1113639367/001 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD ode-gyp-bin/nodelist ache/go/1.25.8/x--json (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name itbranch_with_hyphen2787514997/002/work 64/bin/go **/*.ts **/*.json --ignore-path git cat-�� edOutput1474373284/001 blob ache/go/1.25.8/x64/bin/go --write ../../../**/*.jsconfig 64/bin/go go (http block)
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE cal/bin/sh GOINSECURE GOMOD GOMODCACHE go env 5903-67980/test-904746079/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name LsRemoteWithRealGitbranch_with_hyphen2787514997/001' 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.8/xremote -V=f�� edOutput1474373284/001 node x_amd64/vet --write ../../../**/*.jsrev-parse 64/bin/go x_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go list�� -m -json x_amd64/vet echo "��� JSON fgit go 64/bin/go x_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go env heck '**/*.cjs' '**/*.ts' '**/*.json' --ignore-premote.origin.url GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env 2457249244 GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE At,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go env Onlyrepos_only_without_min-integrity1113639367/001 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env ions-build/main.go GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.prettiuser.email go env -json GO111MODULE sole.test GOINSECURE GOMOD GOMODCACHE sole.test (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh GOINSECURE GOMOD GOMODCACHE go env OnlyCompiledOutput2716564140/001 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linutest@example.com (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE .cfg GOINSECURE GOMOD GOMODCACHE go env 774483018 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go go env erate-action-metadata/main.go GO111MODULE 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 **/*.ts 64/bin/go --ignore-path ../../../.pretticonfig 64/bin/go go env -json GO111MODULE .test GOINSECURE GOMOD GOMODCACHE .test (http block)
  • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name efaultBranchFromLsRemoteWithRealGitcustom_branch4100227546/001' .cfg GOINSECURE GOMOD GOMODCACHE go env 774483018 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -c=4 -nolocalimports -importcfg /tmp/go-build1523173842/b392/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/internal/tools/generate-action-metadata/main.go go tion�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOWORK 64/bin/go node /hom�� mpiledOutput74094025/001 scripts/**/*.js 64/pkg/tool/linux_amd64/link .prettierignore !../../../pkg/woconfig 64/bin/go 64/pkg/tool/linutest@example.com (http block)
• https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
  • Triggering command: /tmp/go-build1523173842/b404/cli.test /tmp/go-build1523173842/b404/cli.test -test.testlogfile=/tmp/go-build1523173842/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go 1/x6�� -json GO111MODULE ache/go/1.25.8/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /tmp/go-build1060725283/b404/cli.test /tmp/go-build1060725283/b404/cli.test -test.testlogfile=/tmp/go-build1060725283/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git DefaultBranchFrogit DefaultBranchFrorev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE ache/node/24.14.--show-toplevel git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.8/x/tmp/gh-aw/aw-feature-branch.patch git (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv e-analyzer.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go itma�� -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go _bra�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go 5426�� setup/js && npm run check:pkg-jsGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go ache�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env Gitmaster_branch2322961685/001' Gitmaster_branch2322961685/001' ode_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE h GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --ignore-path .prettierignore 64/bin/go go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE e/git-receive-pack GOINSECURE GOMOD GOMODCACHE (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo ache/go/1.25.8/xGOMODCACHE GOINSECURE GOMOD GOMODCACHE go 1/x6�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/node GOINSECURE GOMOD GOMODCACHE go 1/x6�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ache/go/1.25.8/x64/bin/go --write ../../../**/*.jsconfig 64/bin/go go env -h gh-aw.wasm | cut -f1))" GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 1/x64/lib/node_mGOMODCACHE GOINSECURE GOMOD GOMODCACHE go tion�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -template-expressions.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/test/repo
  • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch -json GO111MODULE .test GOINSECURE GOMOD GOMODCACHE .test 5231�� 89/001/test-inlined-imports-enabled-with-body-content.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch xterm-color -tests /usr/bin/git -json GO111MODULE modules/@npmcli/--show-toplevel git rev-�� --show-toplevel go om/myorg/repo.git ath ../../../.prgit GO111MODULE 64/bin/go git (http block)
• invalid.example.invalid
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git e/git init�� 86_64/git git ode_modules/.bin/git =receive test@example.com--git-dir=/tmp/bare-incremental-7kJSV3 bin/git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot recompile and make sure the editorial content is imported in the prompt.

[Copilot]

@copilot recompile and make sure the editorial content is imported in the prompt.

Fixed in commit 8733c09. The lock file now shows {{#runtime-import .github/shared/editorial.md}} as an explicit macro in the compiled prompt, before the main workflow file:

{{#runtime-import .github/workflows/shared/reporting-otlp.md}}
{{#runtime-import .github/workflows/shared/reporting.md}}
{{#runtime-import .github/workflows/shared/observability-otlp.md}}
{{#runtime-import .github/shared/editorial.md}}   ← explicit
{{#runtime-import .github/workflows/daily-team-status.md}}

The fix adds ExtractBodyLevelImportPaths to the parser package. At compile time, body-level {{#import:}} directives are now promoted to explicit {{#runtime-import}} macros in the compiled prompt (same treatment as frontmatter imports:). At runtime, runtime_import.cjs's importedFiles dedup Set prevents the file from being imported a second time when the workflow body is processed.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw vBMo52U5-Vb3 (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build492272662/b286/embedcfg -pack (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/node/24.14.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE git t-26�� k/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md GOPROXY /opt/hostedtoolcache/node/24.14.1/x64/bin/node GOSUMDB GOWORK 64/bin/go node (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv che/go-build/57/GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcGO111MODULE -o /tmp/go-build170GOINSECURE -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel sh /usr/bin/git "prettier" --chetr GOPROXY 64/bin/go git rev-�� --show-toplevel gcc /usr/bin/git -x c 64/bin/go git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git 93/001/test-inligit GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE er GOMODCACHE go (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git tmatter-with-arrgit GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v9
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /usr/bin/git GOINSECURE GOMOD GOMODCACHE git (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ithub/workflows/archie.md GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /usr/bin/infocmp GOINSECURE GOMOD GOMODCACHE infocmp (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /usr/bin/infocmp GOINSECURE GOMOD GOMODCACHE infocmp (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /usr/bin/gh GOINSECURE GOMOD GOMODCACHE gh (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/node/24.14.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go t-22�� sistency_InlinedImports471140683/001/inlined-b.md GO111MODULE /usr/bin/git GOINSECURE GOMOD GOMODCACHE git (http block)
• https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE ache/node/24.14.1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go t-21�� sistency_InlinedImports471140683/001/inlined-a.md GO111MODULE /usr/bin/git GOINSECURE GOMOD GOMODCACHE git (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv ref/tags/v1.0.0 sh sv "prettier" --chegit sh 64/bin/go node /tmp�� /home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agent-performance-analyzer.md go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --cGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --cGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[pelikhan]

@copilot review the documentation

[Copilot]

@copilot review the documentation

Updated in commit de43ca5. The docs/src/content/docs/reference/imports.md body-level directive section now covers:

• All syntax variants: {{#import: filepath}} (colon form, used in the daily workflows), {{#import filepath}} (bare form), {{#import?: filepath}} (optional), with a note that the colon is optional
• Content injection vs configuration merging: a Note callout explains that body-level {{#import}} injects markdown text at the insertion point — it does not merge frontmatter configuration — and points to imports: frontmatter for sharing tools/permissions/MCP servers
• Repo-root-relative paths: documents that paths starting with .github/ are resolved from the repository root, suitable for shared files across workflow directories (e.g. .github/shared/editorial.md)
• Optional imports section: expanded to show both the frontmatter ? form and the body {{#import?: ...}} form side-by-side

[pelikhan]

@copilot compare runtime-imports and imports

[Copilot]

@copilot compare runtime-imports and imports

Updated in commit 90e02c2:

{{#import filepath}} — body-level shorthand; local files only; colon form ({{#import: filepath}}); normalizes to {{#runtime-import}} at runtime.

{{#runtime-import filepath}} — full runtime macro; supports URLs, line ranges (file.go:10-20), and URL caching; what the compiler generates in lock files; also what {{#import}} is normalized to.

Changes:

• imports.md: added a sentence after the NOTE callout explaining the normalization relationship and when to use {{#runtime-import}} directly (URLs, line ranges), with a link to the Runtime Imports reference.
• templating.md: added a "Relationship to {{#import}}" subsection in the Runtime Imports section summarizing the comparison; also removed the incorrect "No recursion" limitation bullet (both directives have always been processed recursively).

[github-actions]

Hey @Copilot 👋 — great work on this fix! Resolving \{\\{\#import}} directives in workflow markdown bodies at both compile and runtime is a meaningful improvement, and the detailed PR description makes the root cause and solution very easy to follow.

The PR looks well-structured: tests are included for both the JS runtime layer and the Go parser/compiler, the new editorial.md shared prompt nicely exercises the fix in real workflows, and no new dependencies are introduced.

This PR is currently a draft — once you're ready for review, marking it ready and requesting a review from the assigned reviewers should be all that's needed. ✅

Generated by Contribution Check · ● 731K · ◷

[github-actions]

🧪 Test Quality Sentinel Report

Test Quality Score: 80/100

✅ Excellent test quality

Metric	Value
New/modified tests analyzed	11
✅ Design tests (behavioral contracts)	11 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	11 (100%)
Duplicate test clusters	0
Test inflation detected	⚠️ Minor (runtime_import.test.cjs +57 lines vs runtime_import.cjs +26 lines = 2.19:1 ratio)
🚨 Coding-guideline violations	None

---

Test Classification Details

View All Test Classifications (11 tests)

Test	File	Classification	Notes
should resolve \{\\{\#import filepath}} (no colon) as runtime-import	actions/setup/js/runtime_import.test.cjs	✅ Design	Verifies end-to-end import resolution output
should resolve \{\\{\#import?}} optional variant	actions/setup/js/runtime_import.test.cjs	✅ Design	Happy path with optional syntax
should resolve \{\\{\#import:}} colon syntax	actions/setup/js/runtime_import.test.cjs	✅ Design	Variant syntax resolution
should resolve \{\\{\#import?:}} optional colon syntax	actions/setup/js/runtime_import.test.cjs	✅ Design	Variant syntax resolution
should return empty string for missing optional \{\\{\#import?}} file	actions/setup/js/runtime_import.test.cjs	✅ Design	Edge case: missing file + warning check
should throw for missing required \{\\{\#import}} file	actions/setup/js/runtime_import.test.cjs	✅ Design	Error path: .rejects.toThrow() on missing file
should resolve \{\\{\#import}} inside file read via \{\\{\#runtime-import}} (nested fix)	actions/setup/js/runtime_import.test.cjs	✅ Design	Main bug scenario: end-to-end nested import chain
should resolve multiple \{\\{\#import}} directives in one file	actions/setup/js/runtime_import.test.cjs	✅ Design	Multi-import ordering check
should not treat \{\\{\#importantthing}} as an import directive	actions/setup/js/runtime_import.test.cjs	✅ Design	Edge case: false-positive guard
TestManifestIncludePathRelativeToRepoRoot	pkg/workflow/manifest_test.go	✅ Design	Verifies relative (not absolute) paths in lock file
TestBodyLevelImportPromotedToRuntimeImport	pkg/workflow/manifest_test.go	✅ Design	Verifies \{\\{\#runtime-import}} macro emitted and ordered correctly

---

Flagged Tests — Minor Notes

No tests are flagged for quality concerns. Two minor observations:

i️ runtime_import.test.cjs — slight test inflation (2.19:1)

The test file added 57 lines vs the production file's 26 lines. The ratio (2.19:1) marginally exceeds the 2:1 threshold. This is not concerning given the tests cover 9 distinct scenarios (4 syntax variants, 2 error paths, 1 regression scenario, 1 multi-import case, 1 false-positive guard) — the additional test volume is justified.

i️ TestManifestIncludePathRelativeToRepoRoot — assertion messages

All t.Errorf and t.Fatalf calls include context messages ✅. The os.MkdirAll / os.WriteFile error checks use t.Fatal(err) (bare error, no message) for setup steps — acceptable for setup failures but could be more descriptive (e.g., t.Fatalf("create workflows dir: %v", err)).

---

Language Support

Tests analyzed:

• 🐹 Go (*_test.go): 2 tests (unit, //go:build !integration ✅)
• 🟨 JavaScript (*.test.cjs): 9 tests (vitest)

---

Verdict

✅ Check passed. 0% of new tests are implementation tests (threshold: 30%). All 11 new tests directly verify observable behavior of the \{\\{\#import}} directive feature, including error paths, edge cases, and the core regression scenario.

---

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

• Assert on observable outputs, return values, or state changes
• Cover error paths and boundary conditions
• Would catch a behavioral regression if deleted
• Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

• Assert on internal function calls (mocking internals)
• Only test the happy path with typical inputs
• Break during legitimate refactoring even when behavior is correct
• Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

---

References: §24919963205

🧪 Test quality analysis by Test Quality Sentinel · ● 646.7K · ◷

[github-actions]

✅ Test Quality Sentinel: 80/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%). All 11 new tests verify observable behavioral contracts of the \{\\{\#import}} directive fix.

[github-actions]

Commit pushed: b048a8b

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (279 new lines in pkg/) but does not have a linked Architecture Decision Record (ADR).

AI has analyzed the PR diff and generated a draft ADR to help you get started:

📄 Draft ADR: docs/adr/28366-two-phase-resolution-of-body-level-import-directives.md

The draft captures the key architectural decision: resolving body-level \{\\{\#import}} directives via a two-phase approach — compile-time promotion in Go (ExtractBodyLevelImportPaths → explicit \{\\{\#runtime-import}} macros in the lock file) combined with runtime normalisation in JavaScript (processRuntimeImports). It also covers the alternatives considered and the trade-offs of keeping two language-boundary codepaths in sync.

What to do next

1. Review the draft ADR committed to your branch — it was generated from the PR diff
2. Complete any missing sections — add context the AI couldn't infer, refine the decision rationale, and verify the alternatives accurately reflect what you actually considered
3. Confirm or update the status from Draft to Proposed once you're happy with the content
4. Reference the ADR in this PR body by adding a line such as:

   ADR: ADR-28366: Two-Phase Resolution of Body-Level \{\\{\#import}} Directives

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

---

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

• Context — What is the problem? What forces are at play?
• Decision — What did you decide? Why?
• Alternatives Considered — What else could have been done?
• Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number (e.g., 28366-two-phase-resolution-of-body-level-import-directives.md for this PR).

🔒 This PR cannot merge until an ADR is linked in the PR body.

References: §24919963187

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · ● 237.3K · ◷

[Copilot]

Pull request overview

Fixes body-level {{#import ...}} directives so their referenced content is injected into the runtime prompt (and made visible in compiled lockfile prompts), while also improving include-path recording in lockfile manifests to avoid absolute filesystem paths.

Changes:

• Normalize {{#import ...}} → {{#runtime-import ...}} in runtime_import.cjs (including nested imports) and add JS tests for the supported variants.
• Enhance Go compiler/parser to (a) record sibling .github/ includes as repo-root-relative paths and (b) promote body-level imports to explicit {{#runtime-import}} macros in compiled prompts; add Go tests.
• Add shared editorial prompt snippet and update select workflows + regenerated lockfiles to import shared snippets / noop reminder.

Show a summary per file

File	Description
pkg/workflow/manifest_test.go	Adds tests for repo-root-relative include paths and body-import promotion behavior
pkg/workflow/compiler_orchestrator_tools.go	Promotes body-level imports into runtime-import macro generation list
pkg/parser/include_expander.go	Adds repo-root-relative include path recording + body-import extraction helper
docs/src/content/docs/reference/templating.md	Documents relationship between {{#import}} and {{#runtime-import}}
docs/src/content/docs/reference/imports.md	Expands docs/examples for body-level {{#import}} usage and optional form
actions/setup/js/runtime_import.cjs	Normalizes body-level {{#import}} to runtime-import and recurses through nested imports
actions/setup/js/runtime_import.test.cjs	Adds test coverage for body-level import variants and nested scenario
.github/shared/editorial.md	New shared prompt snippet for editorial tone
.github/workflows/daily-news.md	Adds body-level import of shared editorial snippet
.github/workflows/daily-issues-report.md	Adds body-level import of shared editorial snippet
.github/workflows/daily-team-status.md	Adds body-level import of shared editorial snippet
.github/workflows/daily-news.lock.yml	Regenerated lockfile prompt/includes reflecting new runtime-imports
.github/workflows/daily-issues-report.lock.yml	Regenerated lockfile prompt/includes reflecting new runtime-imports
.github/workflows/daily-team-status.lock.yml	Regenerated lockfile prompt/includes reflecting new runtime-imports
.github/workflows/workflow-skill-extractor.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/workflow-normalizer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/workflow-health-manager.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/workflow-generator.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/weekly-issue-summary.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/weekly-editors-health-check.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/video-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/unbloat-docs.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/ubuntu-image-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/typist.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/tidy.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/test-project-url-default.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/test-dispatcher.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/test-create-pr-error-handling.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/terminal-stylist.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/technical-doc-writer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/super-linter.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/sub-issue-closer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/step-name-alignment.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/static-analysis-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/stale-repo-identifier.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/spec-librarian.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/spec-extractor.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/spec-enforcer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-workflow-call.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-test-tools.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-temporary-id.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-project.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-opencode.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-multi-pr.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-gemini.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-crush.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-copilot.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-copilot-arm.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/smoke-codex.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import (plus regenerated heredoc IDs)
.github/workflows/smoke-claude.lock.yml	Updates compiled prompt content with explicit noop reminder block
.github/workflows/sergo.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/semantic-function-refactor.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/security-review.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/security-compliance.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/scout.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/schema-consistency-checker.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/safe-output-health.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/research.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/repository-quality-improver.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/repo-tree-map.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/repo-audit-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/release.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/refiner.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/q.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/python-data-charts.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/prompt-clustering-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/pr-triage-agent.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/poem-bot.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/plan.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/pdf-summary.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/org-health-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/mergefest.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/mcp-inspector.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/lockfile-stats.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/layout-spec-maintainer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/jsweep.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/issue-triage-agent.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/issue-arborist.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import (plus regenerated heredoc IDs)
.github/workflows/instructions-janitor.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/grumpy-reviewer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import (plus regenerated heredoc IDs)
.github/workflows/gpclean.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/go-pattern-detector.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/go-logger.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/go-fan.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/glossary-maintainer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/github-mcp-tools-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/github-mcp-structural-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/functional-pragmatist.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/firewall-escape.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/example-workflow-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/draft-pr-cleanup.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/docs-noob-tester.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/discussion-task-miner.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/dictation-prompt.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/developer-docs-consolidator.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/dev.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/dev-hawk.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/dependabot-go-checker.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/dependabot-burner.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/delight.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/deep-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-workflow-updater.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-token-consumption-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-testify-uber-super-expert.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-team-evolution-insights.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-syntax-error-quality.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-semgrep-scan.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-secrets-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-safe-output-optimizer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-repo-chronicle.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-regulatory.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-performance-summary.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-observability-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import (plus regenerated heredoc IDs)
.github/workflows/daily-firewall-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-file-diet.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-fact.lock.yml	Updates compiled prompt content with explicit noop reminder block (plus regenerated heredoc IDs)
.github/workflows/daily-doc-updater.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-compiler-quality.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-code-metrics.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-cli-performance.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-choice-test.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/daily-assign-issue-to-user.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/craft.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-session-insights.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-opt.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-cli-deep-research.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/copilot-agent-analysis.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/contribution-check.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/commit-changes-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/code-simplifier.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/code-scanning-fixer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/cloclo.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/cli-version-checker.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/cli-consistency-checker.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/claude-code-user-docs-review.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/ci-coach.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/brave.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/bot-detection.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/blog-auditor.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/auto-triage-issues.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/audit-workflows.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/artifacts-summary.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/architecture-guardian.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/archie.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/ai-moderator.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import
.github/workflows/agent-performance-analyzer.lock.yml	Regenerated lockfile prompt to include noop-reminder runtime-import

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 154/154 changed files
• Comments generated: 5

[Copilot]

This section says {{#import ...}} does not support URLs, line ranges, or the .github/ prefix, but the runtime implementation now normalizes {{#import ...}} to {{#runtime-import ...}}, which does support those features. Please update the docs to avoid understating what {{#import}} can do (or explicitly document any intentional restrictions if you plan to enforce them).

[Copilot]

ExtractBodyLevelImportPaths returns an Optional flag, but this promotion logic drops it by appending only bi.Path. That means {{#import? ...}} / {{#import?: ...}} directives will be promoted into required {{#runtime-import ...}} macros in the compiled prompt, changing behavior and potentially failing runs when an optional file is missing. Preserve optionality when generating the runtime-import macros (e.g., emit the optional form when bi.Optional is true).

[Copilot]

ExtractBodyLevelImportPaths treats paths as absolute only when they start with "/". On Windows, absolute paths like "C:/..." won't match and will be incorrectly treated as relative, leading to malformed workspace-root-relative paths in promoted runtime-import macros. Use filepath.IsAbs(importPath) (and/or handle volume names) instead of the string prefix check.

[Copilot]

The recursion trigger /\{\{#(?:runtime-import|import)/ is broad enough to match non-import macros like {{#importantthing}} (since it starts with {{#import), causing an unnecessary recursive processRuntimeImports pass and misleading "Recursively processing imports" logs. Tighten the detection to only match valid {{#runtime-import...}} or {{#import...}} directives (including the required separator), or reuse the same regexes used for normalization/matching.

[Copilot]

This test’s absolute-path guard only checks for # - /..., which won’t catch Windows absolute paths once they’ve been normalized with forward slashes (e.g. # - C:/Users/...). Since CI runs on windows-latest, consider checking for drive-letter prefixes (e.g. ^[A-Za-z]:/) or parsing the path portion and using filepath.IsAbs to make the assertion cross-platform.

[pelikhan]

@copilot the #import syntax should be deprecated. The use should use runtime-import or the frontmatter imports.

[Copilot]

@copilot the #import syntax should be deprecated. The use should use runtime-import or the frontmatter imports.

Done in commit e182e33. The {{#import}} syntax is now deprecated:

• Compile time (import_directive.go + include_processor.go): all {{#import}} forms are marked as legacy, emitting: Deprecated syntax: "{{#import ...}}". Use {{#runtime-import ...}} for content injection or the 'imports:' frontmatter field for configuration merging.
• Runtime (runtime_import.cjs): core.warning is now emitted when any {{#import}} directive is normalized to {{#runtime-import}}
• Daily workflows: updated from {{#import: .github/shared/editorial.md}} → {{#runtime-import .github/shared/editorial.md}}
• Lock file promotion: ExtractBodyLevelImportPaths now promotes body-level {{#runtime-import}} directives (not deprecated {{#import}}); optional {{#runtime-import?}} are excluded to prevent them being promoted as required macros
• Docs: imports.md now shows {{#runtime-import}} as the primary syntax with a WARNING callout explaining the deprecation; templating.md notes the deprecated form

The old {{#import}} syntax still works at runtime for backward compatibility.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE node /opt�� run lint:cjs 64/bin/go GOSUMDB GOWORK run-script/lib/n-json sh (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c npx prettier --cGOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv prettier --check $name) { hasDiscussionsEnabled } } **/*.ts **/*.json --ignore-path git -c log.showsignaturGOINSECURE log 64/bin/go -n1 --format=format:-C --end-of-options/home/REDACTED/work/gh-aw/gh-aw/.github/workflows go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv che/go-build/51/GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK run-script/lib/n--noprofile /opt/hostedtoolcGOPROXY -o /tmp/go-build428GOSUMDB -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch 84cd19869519e2483d905a40:.github-f /usr/bin/gh cal/bin/git ck.yml -f (http block)
• invalid.example.invalid
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git e/git init�� ndor/bin/git git ode_modules/.bin/git =receive test@example.com--git-dir=/tmp/bare-incremental-nWs3oM /git (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)