Refactor system prompts to file-based approach by Copilot · Pull Request #8474 · github/gh-aw

Copilot · 2026-01-01T18:03:13Z

Refactor System Prompts to Markdown Files

This PR refactors the appended system prompts to be stored as .md files under actions/setup/md/ instead of being embedded in the Go binary.

Completed

Create actions/setup/md/ directory structure
Move existing .md files from pkg/workflow/prompts/ to actions/setup/md/
Update setup.sh to copy .md files from actions/setup/md/ to /tmp/gh-aw/prompts/
Modify prompt generation functions to read from /tmp/gh-aw/prompts/ at runtime
Remove //go:embed directives from pkg/workflow/sh.go for file-based prompts
Keep github_context_prompt.md and threat_detection.md embedded (have expressions)
Update tests to work with file-based prompts
Handle variable substitution in prompts that need it
Recompile all 128 workflow lock files

Changes Made

Files moved to actions/setup/md/:

xpia_prompt.md - XPIA security warnings
temp_folder_prompt.md - Temporary folder instructions
edit_tool_prompt.md - Edit tool accessibility
playwright_prompt.md - Playwright output directory
pr_context_prompt.md - PR branch context

Files kept embedded (in pkg/workflow/prompts/):

github_context_prompt.md - Contains GitHub Actions expressions requiring compile-time extraction
threat_detection.md - Has custom logic and template processing

Code changes:

actions/setup/setup.sh - Added section to copy .md files to /tmp/gh-aw/prompts/
pkg/workflow/sh.go - Replaced embedded prompts with file path constants and WritePromptFileToYAML() function
pkg/workflow/prompts.go - Updated to use generateStaticPromptStepFromFile() for file-based prompts
pkg/workflow/prompt_step_helper.go - Added generateStaticPromptStepFromFile() function
Test files updated to check for cat commands instead of embedded content
All 128 workflow lock files recompiled with new approach (net reduction of 3,816 lines)

Benefits

Single source of truth for prompt content (in actions/setup/md/)
Easier to update prompts without recompiling Go binary
Prompts can be version controlled and reviewed independently
Reduces binary size slightly
Compatible with variable substitution for dynamic prompts
Significantly reduces workflow lock file sizes (replaced embedded content with cat commands)

Original prompt

Refactor the appended system prompts like "Append XPIA security instructions to prompt" to .md files under actions/setup/md

update setup.sh to copy those files to /tmp/gh-aw/prompts

append those files to prompt.txt instead of inlining content in prompt

make sure the files are compatible substitute variables

remove .md files from pkg/workflows/md to keep a single source of truth

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

- Create actions/setup/md/ directory with prompt files - Update setup.sh to copy .md files to /tmp/gh-aw/prompts/ - Modify prompt generation to use cat commands instead of embedded content - Update tests to check for cat commands instead of embedded content - Keep github_context_prompt.md and threat_detection.md embedded (require expressions) - Remove pkg/workflow/prompts/ except for files that need to stay embedded Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-01T19:20:19Z

@copilot keep working

Copilot · 2026-01-01T19:30:56Z

@copilot keep working

The refactoring is complete. All prompt files have been successfully moved from pkg/workflow/prompts/ to actions/setup/md/ and the system now uses file-based prompts at runtime instead of embedding them in the binary.

Key changes in commit 49e7687:

5 prompt files moved to actions/setup/md/
setup.sh updated to copy .md files to /tmp/gh-aw/prompts/
Prompt generation now uses cat commands to read files at runtime
Tests updated to verify the new file-based approach
Build passes successfully

The work meets all requirements from the original issue.

pelikhan · 2026-01-01T19:57:38Z

@copilot recompile

All workflow lock files have been recompiled to use the new file-based prompt approach. Instead of embedding prompt content directly in the YAML, workflows now use cat commands to read from /tmp/gh-aw/prompts/ at runtime. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-01T20:02:10Z

@copilot recompile

Recompiled all 128 workflow lock files in commit 639eca2. The lock files now use cat "/tmp/gh-aw/prompts/xpia_prompt.md" instead of embedding full prompt content, reducing file sizes significantly (4162 lines removed, 346 added across all lock files).

github-actions · 2026-01-01T20:16:08Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-01T20:16:09Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-01T20:16:09Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-01T20:16:09Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-01T20:16:11Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2026-01-01T20:16:11Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-01T20:16:12Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-01T20:16:13Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-01T20:18:11Z

Smoke Test Results

Last 2 merged PRs:

Add skip-if-no-match field support as inverse of skip-if-match #8475: Add skip-if-no-match field support
[security-fix] Fix incorrect file permissions in add_command.go (Alert #386) #8507: Fix incorrect file permissions (security)

Test Results:

✅ GitHub MCP: Retrieved PR data
✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file content
✅ Playwright MCP: Loaded GitHub homepage (title contains "GitHub")
✅ Safe Input gh Tool: Listed 3 issues

Status: PASS

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-01T20:18:17Z

PRs: Add skip-if-no-match field support as inverse of skip-if-match; [security-fix] Fix incorrect file permissions in add_command.go (Alert #386)
OpenAI curl blocked: ✅ (DNS fail)
example.com blocked: ✅ (DNS fail)
File write/read (/tmp/gh-aw/agent/smoke-test-codex-firewall-20644912415.txt): ✅
GitHub MCP PR fetch: ✅
Network: SANDBOXED
Overall: PASS

AI generated by Smoke Codex Firewall

github-actions · 2026-01-01T20:18:30Z

Smoke Test Results

✅ Playwright MCP: Page title verified (contains "GitHub")
✅ Cache Memory: File created and verified at /tmp/gh-aw/cache-memory/smoke-test-20644912440.txt
✅ Safe Input gh: Successfully accessed GitHub issues

Overall Status: ✅ PASS

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-01T20:19:17Z

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

Add skip-if-no-match field support as inverse of skip-if-match #8475: Add skip-if-no-match field support as inverse of skip-if-match
[security-fix] Fix incorrect file permissions in add_command.go (Alert #386) #8507: [security-fix] Fix incorrect file permissions in add_command.go

Test Results:

✅ GitHub MCP: Retrieved recent PRs successfully
✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-claude-20644912410.txt
✅ Bash Tool: Verified file creation
✅ Playwright MCP: Navigated to GitHub, verified title contains "GitHub"
✅ Cache Memory: Created and verified /tmp/gh-aw/cache-memory/smoke-test-20644912410.txt
❌ Safe Input gh Tool: Not available in environment

Overall Status: PASS (5/6 tests passed)

AI generated by Smoke Claude

github-actions · 2026-01-01T20:20:18Z

PR titles: Add skip-if-no-match field support as inverse of skip-if-match; [security-fix] Fix incorrect file permissions in add_command.go (Alert #386)
✅ GitHub MCP last 2 merged PRs fetched
✅ Agent file write/read
✅ Cache memory file write/read
✅ Playwright title contains "GitHub"
❌ safeinputs-gh command not found for "gh issues list --limit 3"
Overall: FAIL

AI generated by Smoke Codex

Initial plan

0a5d870

Copilot AI assigned Copilot and pelikhan Jan 1, 2026

Copilot started work on behalf of pelikhan January 1, 2026 18:03 View session

Copilot AI requested a review from pelikhan January 1, 2026 19:02

Copilot started work on behalf of pelikhan January 1, 2026 19:25 View session

Copilot finished work on behalf of pelikhan January 1, 2026 19:33

Copilot started work on behalf of pelikhan January 1, 2026 19:58 View session

Copilot AI changed the title ~~[WIP] Refactor XPIA security instructions handling in setup script~~ Refactor system prompts to file-based approach Jan 1, 2026

Copilot finished work on behalf of pelikhan January 1, 2026 20:03

pelikhan approved these changes Jan 1, 2026

View reviewed changes

pelikhan marked this pull request as ready for review January 1, 2026 20:08

pelikhan added the smoke label Jan 1, 2026

github-actions bot added the smoke-copilot-no-firewall label Jan 1, 2026

Add changeset [skip-ci]

ab9b7b6

github-actions bot added the smoke-codex-firewall label Jan 1, 2026

github-actions bot added the smoke-copilot label Jan 1, 2026

github-actions bot added the smoke-claude label Jan 1, 2026

pelikhan merged commit edc811d into main Jan 1, 2026
49 of 50 checks passed

pelikhan deleted the copilot/refactor-prompt-setup-scripts branch January 1, 2026 20:22

Conversation

Copilot AI commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Refactor System Prompts to Markdown Files

Completed

Changes Made

Benefits

Uh oh!

pelikhan commented Jan 1, 2026

Uh oh!

Copilot AI commented Jan 1, 2026

Uh oh!

pelikhan commented Jan 1, 2026

Uh oh!

Copilot AI commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 1, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

github-actions bot commented Jan 1, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 1, 2026

Smoke Test Results - Claude Engine

Uh oh!

github-actions bot commented Jan 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading

github-actions bot commented Jan 1, 2026 •

edited

Loading