fix: use roles: all workaround for bot activation (gh-aw#21098)#76
Merged
fix: use roles: all workaround for bot activation (gh-aw#21098)#76
Conversation
check_membership.cjs has a bug where the error branch from a 404 (GitHub App actors are not users) exits before the bot allowlist fallback is evaluated. This makes the bots: field ineffective. Workaround: roles: all skips the permission check entirely so check_membership.cjs is not included in pre_activation. Previous attempts that didn't fix this: - PR #64: bots: at top level (ignored by compiler) - PR #65: bots: under on: (correct placement, but runtime bug) - PR #72: added Copilot to bots list (correct actor, but bot check unreachable) Tracked for removal when upstream is fixed: #74 Upstream bug: github/gh-aw#21098 Closes #75 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR works around an upstream bug in gh-aw's check_membership.cjs (gh-aw#21098) that prevents bot actors like Copilot from activating agent workflows. The roles: all directive skips the broken permission check entirely, allowing the workflows to activate.
Changes:
- Added
roles: alltoreview-responder.mdandquality-gate.mdfrontmatter, and recompiled lock files (removing thepre_activationjob and its references) - Updated
docs/agentic-workflows.mdto document the upstream bug, workaround, and investigation history - Updated
docs/changelog.mdwith the workaround entry and a note on PR #72's insufficiency
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/review-responder.md |
Added roles: all to skip permission check |
.github/workflows/quality-gate.md |
Added roles: all to skip permission check |
.github/workflows/review-responder.lock.yml |
Recompiled: removed pre_activation job and its references |
.github/workflows/quality-gate.lock.yml |
Recompiled: removed pre_activation job and its references |
docs/agentic-workflows.md |
Documented upstream bug, workaround, updated pitfalls and debugging sections |
docs/changelog.md |
Added workaround entry and retrospective note on PR #72 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
15 tasks
This was referenced Mar 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Agent workflows (review-responder, quality-gate) never activate when triggered by Copilot review events.
pre_activationcompletes successfully butactivatedoutput isfalse, causingactivationandagentjobs to be skipped.Root Cause
Upstream bug in gh-aw's
check_membership.cjs(github/gh-aw#21098). When a GitHub App actor (e.g.,Copilot) triggers the workflow,getCollaboratorPermissionLevel()returns a 404. Theif (result.error)branch exits immediately — before theGH_AW_ALLOWED_BOTSfallback is ever evaluated. Thebots:field compiles correctly but the runtime never checks it.Fix
Add
roles: allto skip the permission check entirely. Withroles: all, the compiler setsneedsRoleCheck = falseand omitscheck_membership.cjsfrom thepre_activationjob. Theactivatedoutput defaults totrueand the agent runs.This is overly permissive (any actor can trigger the workflow) but is the only viable workaround until the upstream bug is fixed.
Previous Attempts (all merged, none fixed it)
bots:at top level +roles: all. Wrong: top-levelbots:is silently ignored by the compiler. Ironically, theroles: allpart would have worked, but we didn't understand why and reverted it in PR fix: correct bots: placement under on: for agent activation #65.bots:underon:(correct placement), removedroles: all. Fixed the compilation but didn't fix activation because of the upstream bug.Copilotto the bots list (correct actor name). Irrelevant becausecheck_membership.cjsnever reaches the bot check.Changes
roles: alltoreview-responder.mdandquality-gate.mdbots: [Copilot, copilot-pull-request-reviewer](harmless, needed when upstream is fixed)check_membership.cjsstep removed,pre_activationjob removed)docs/agentic-workflows.md(activation section, pitfall ci: enable GitHub Advanced Security (GHAS) #8, debugging, history)docs/changelog.md(corrected PR fix: add Copilot actor to bots list for agent activation #72 entry, added workaround entry)Closes
Related