Repository navigation
Suggest lock exclusion for workflow permission push failures - #72423
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
![github-actions[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: no blocking findings
The workflow-permission diagnostic is narrowly matched, preserves the original error, and is covered for direct and signed-push fallback paths. I found no actionable correctness, security, or performance issue in the changed lines.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~3 AIC · ⌖ ~1 AIC · ⊞ 1.6K
Comment /review to run again
There was a problem hiding this comment.
🟡 Changes recommended
The shared helper incorrectly recommends exclude-lock-yml for maintenance pushes without safe outputs, where missing workflow-write permissions instead require appropriately authorized credentials.
1 open issue
What changed in this PR
Adds workflow-permission diagnostics to gh-aw’s shared push handling, helping safe-output users identify when generated workflow locks can be excluded.
Changes:
- Suggests
exclude-lock-yml: truefor matching GitHub rejections while preserving the original error. - Covers direct and signed-push failure paths without changing credentials or retry behavior.
- Adds regression tests and documents the diagnostic.
| File | Description |
|---|---|
docs/src/content/docs/reference/safe-outputs-pull-requests.md |
Documents the permission hint and its limits. |
actions/setup/js/push_signed_commits.test.cjs |
Tests token rejection variants, unrelated failures, and fallback behavior. |
actions/setup/js/push_signed_commits.cjs |
Detects workflow-permission rejections and appends guidance. |
Review effort: Max
| "If these changes are generated workflow locks, set `exclude-lock-yml: true` on the relevant `safe-outputs` entry " + | ||
| "(for example, `safe-outputs.create-pull-request` or `safe-outputs.push-to-pull-request-branch`) and recompile the workflow. " + | ||
| "Other workflow YAML changes still require credentials permitted to update workflows. " + | ||
| "Regenerate and commit excluded locks with authorized credentials before merging." |
|
🎉 This pull request is included in a new release. Release: |
Summary
GitHub rejects pushes containing workflow YAML when the token lacks workflow-write permission, but the error does not explain how to omit generated workflow locks from safe outputs.
Detects GitHub's workflow-permission rejection in shared JavaScript push handling and appends guidance to set
exclude-lock-yml: trueon the relevantsafe-outputsentry. The original rejection is preserved, and the hint clarifies that other workflow YAML changes still require authorized credentials. Covers direct pushes and signed-push failure paths without changing credentials or retry behavior.Adds regression coverage for GitHub App, PAT, and OAuth rejections, unrelated failures, and signed-push fallback behavior, plus documentation of the diagnostic.
Validation
make fmt-cjs && make lint-cjscd actions/setup/js && npx vitest run push_signed_commits.test.cjs(89 tests passed)make agent-report-progress