Repository navigation
Prevent skipped threat detection from reporting inherited agent tokens - #71933
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
The default detector's skipped-scan path can still report inherited agent tokens.
2 open issues
What changed in this PR
This PR targets double-counted agent tokens on skipped threat-detection spans by updating workflow generation and setup telemetry.
Changes:
- Move inherited usage-file cleanup into an unconditional post-download step.
- Suppress token attributes when detection explicitly concludes as skipped.
- Add cleanup-ordering and token-attribution regression coverage.
| File | Description |
|---|---|
pkg/workflow/threat_detection_job.go |
Adds unconditional cleanup after agent artifact download. |
pkg/workflow/threat_detection_job_test.go |
Checks cleanup ordering and independence from the detection guard. |
actions/setup/sh/prepare_threat_detection_files.sh |
Removes cleanup from gated file preparation. |
actions/setup/sh/prepare_threat_detection_files_test.sh |
Removes obsolete cleanup assertions. |
actions/setup/js/send_otlp_span.test.cjs |
Tests skipped and successful attribution using file and log counters. |
actions/setup/js/send_otlp_span.cjs |
Suppresses token counters for explicitly skipped detection. |
Review effort: Max
| " - name: Clear agent token usage\n", | ||
| " if: always()\n", | ||
| " run: rm -f /tmp/gh-aw/agent_usage.json\n", |
There was a problem hiding this comment.
Updated smoke-copilot.golden with the generated cleanup step and regenerated workflow locks. Commit 1b62477.
| const agentUsageNormalized = normalizeRuntimeTokenUsage(agentUsageRaw); | ||
| const agentUsage = agentUsageNormalized || runtimeMetrics.tokenUsage || {}; | ||
| // A skipped scan has no token usage, even if downloaded agent artifacts contain counters. | ||
| const agentUsage = jobName === "detection" && detectionConclusion === "skipped" ? {} : agentUsageNormalized || runtimeMetrics.tokenUsage || {}; |
There was a problem hiding this comment.
Detection spans now use only threat-detection/detection_usage.json, with no inherited agent file/log fallback even when the conclusion is unset. Tests cover skipped and successful scans with distinct counters. Commit 1b62477.
|
@copilot Fix the code for all comments in this review thread. When a review comment includes a suggested change, apply the suggestion exactly. Do not make changes beyond what is described in the linked review thread. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
🎉 This pull request is included in a new release. Release: |
Skipped threat scans retained the downloaded agent’s usage counters and reported them on detection conclusion spans, double-counting tokens.
agent_usage.jsonremoval from gated preparation into analways()step immediately after artifact download.gen_ai.usage.*for skipped detection, including counters recovered from logs; preserve successful-scan reporting.