Repository navigation
Conversation
Use the pinned yaml package across runtime consumers and deploy its locked dependency during setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use compiler JSON lock headers for worker provisioning and a separate metadata helper for Markdown frontmatter operations. Remove runtime npm parser installation and prevent parser imports and new Go implementations in setup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
pelikhan
changed the title
Deny native helper and subprocess imports while verifying both lock JSON headers and worker provisioning against a deliberately malformed workflow body. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved defects break action builds and setup on default runners, while metadata parsing can omit declared tool restrictions and corrupt protected placeholders.
10 open issues
What changed in this PR
This PR moves Markdown metadata parsing out of gh-aw’s setup JavaScript and limits work-queue verification to bounded compiler JSON headers.
Changes:
- Introduces a separate Go metadata helper with a JSON-only JavaScript bridge.
- Replaces worker workflow-body parsing with compiler-manifest validation.
- Adds runtime boundary guards and updates provisioning, build integration, and regression tests.
| File | Description |
|---|---|
specs/work-queue/verify_native.py |
Removes the deleted parser from source fingerprints. |
specs/work-queue/verify_native_test.py |
Updates fingerprint expectations. |
scripts/agent-report-progress.sh |
Adds validation for the separate helper module. |
Makefile |
Adds helper build, vet, and test targets. |
eslint-factory/src/eslint-config-severity.test.ts |
Removes the obsolete parser-ignore assertion. |
eslint-factory/eslint.config.cjs |
Removes the vendored-parser lint exclusion. |
actions/setup/setup.sh |
Provisions the helper and removes parser deployment entries. |
actions/setup/session_parsers.go |
Updates embedded JavaScript dependencies. |
actions/setup/README.md |
Documents the metadata processing boundary. |
actions/setup/js/workflow_tool_policy_alignment.test.cjs |
Migrates metadata and manifest readers. |
actions/setup/js/workflow_pull_request_migration.test.cjs |
Uses the metadata bridge in workflow checks. |
actions/setup/js/work_queue_yaml.test.cjs |
Deletes legacy parser tests. |
actions/setup/js/work_queue_stress_workflow.test.cjs |
Migrates workflow parsing to the helper. |
actions/setup/js/work_queue_provisioning.cjs |
Verifies workers through bounded manifest headers. |
actions/setup/js/work_queue_provisioning_checks.cjs |
Tests manifest validation and parser-free provisioning. |
actions/setup/js/work_queue_dispatch.test.cjs |
Adds worker manifests to dispatch fixtures. |
actions/setup/js/vitest.config.mjs |
Registers helper compilation before JavaScript tests. |
actions/setup/js/smoke_work_queue_workflows.test.cjs |
Migrates smoke workflow metadata checks. |
actions/setup/js/smoke_claude_sub_agents.test.cjs |
Reads manifests through the bounded header helper. |
actions/setup/js/skill_inventory.cjs |
Delegates skill metadata reading to the helper. |
actions/setup/js/setup_sh_file_lists.test.cjs |
Tests isolated helper provisioning and deployment lists. |
actions/setup/js/setup_runtime_boundary.test.cjs |
Guards setup against parser and Go implementation additions. |
actions/setup/js/scripts/work_queue_yaml/package.json |
Deletes parser-bundle build dependencies. |
actions/setup/js/scripts/work_queue_yaml/entry.mjs |
Deletes the parser bundling entry point. |
actions/setup/js/scripts/work_queue_yaml/build.mjs |
Deletes parser bundling tooling. |
actions/setup/js/prompt_provenance_regressions.test.cjs |
Migrates provenance assertions to the helper. |
actions/setup/js/prompt_literal_values.test.cjs |
Migrates literal-restoration assertions. |
actions/setup/js/prompt_literal_values.cjs |
Delegates source-preserving scalar restoration. |
actions/setup/js/pi_subagent_extension.test.cjs |
Removes the SDK frontmatter parser stub. |
actions/setup/js/pi_subagent_config.test.cjs |
Uses real Markdown metadata fixtures. |
actions/setup/js/pi_subagent_config.cjs |
Reads Pi agent metadata through the bridge. |
actions/setup/js/pi_models_json.test.cjs |
Replaces parser mocks with Markdown fixtures. |
actions/setup/js/model_pin_check.cjs |
Delegates frontmatter document parsing. |
actions/setup/js/markdown_metadata.cjs |
Adds the bounded JSON process bridge. |
actions/setup/js/haiku_printer_workflow.test.cjs |
Migrates workflow parsing assertions. |
actions/setup/js/fuzz_template_substitution_harness.test.cjs |
Migrates scalar round-trip assertions. |
actions/setup/js/extract_inline_sub_agents.test.cjs |
Migrates agent frontmatter assertions. |
actions/setup/js/extract_inline_sub_agents.cjs |
Delegates agent naming and metadata extraction. |
actions/setup/js/engine_subagent_models.test.cjs |
Migrates model metadata assertions. |
actions/setup/js/engine_subagent_models.cjs |
Uses helper-provided metadata and scalar offsets. |
actions/setup/js/daily_squid_image_scan.test.cjs |
Uses bounded manifest-header reads. |
actions/setup/js/daily_report_portfolio.test.cjs |
Migrates compiled workflow checks. |
actions/setup/js/daily_mcp_concurrency_workflow.test.cjs |
Migrates workflow frontmatter checks. |
actions/setup/js/copilot_sdk_session.test.cjs |
Migrates source and compiled workflow checks. |
actions/setup/js/copilot_harness.cjs |
Delegates agent discovery and model scalar extraction. |
actions/setup/js/cache_memory_workflows.test.cjs |
Migrates workflow metadata assertions. |
actions/markdown-metadata/vitest_setup.mjs |
Builds the helper for JavaScript tests. |
actions/markdown-metadata/setup.sh |
Builds the deployed helper executable. |
actions/markdown-metadata/main.go |
Implements bounded parsing and source-preserving edits. |
actions/markdown-metadata/main_test.go |
Tests offsets, validation, naming, and restoration. |
actions/markdown-metadata/go.sum |
Records pinned dependency checksums. |
actions/markdown-metadata/go.mod |
Defines the separate Go module. |
.gitignore |
Excludes generated helper executables. |
Review effort: Max (auto)
|
Copilot assignment requested for the following outstanding work:
Once you start work, post this work summary as a PR comment without the leading Copilot mention, including the Sous-chef head, work, and state lines below, to record that the assignment is running. Apply the necessary fixes on this PR's existing branch, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved; stop when only human review or CI remains. Do not merge or trigger CI. Sous-chef requested-head: 515fcb7
|
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Hey @pelikhan 👋 — thanks for this architectural refactor! The changes are well-organized and thoroughly tested. A few items to confirm before merging:
The PR is well-documented and the changes are cohesive. If the team has signed off on the dependency and deployment model, this looks ready to move forward.
|
Assignment started. I’ll merge the latest Sous-chef requested-head: 515fcb7 |
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…-yaml-helper Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
pelikhan
changed the title
Keep worker fixtures aligned with JSON-only route verification, isolate synthetic harness workspaces from CI checkout agents, and initialize developer-only metadata tooling before timed runtime assertions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Treat Markdown separators as prose, retain inline artifact boundaries, and provision compiler-owned metadata for caller-attribution, analytics, and AW policy fixtures without weakening runtime checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Require compiler provenance for JSON metadata, preserve trusted derived records, handle Markdown fences safely, and normalize Windows boundary paths. Regenerate workflow locks after merging origin/main. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep strict runtime provenance enabled while supplying compiler records for staged model-resolution test agents. Preserve all existing model availability assertions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Integrate the new skip-if-decision workflows and default-branch health sampling updates, regenerating compiled locks from merged sources. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Preserve structured session tool results, merge the default Gemini run-info fixes, and regenerate compiler outputs while retaining the JSON-only setup runtime. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Regarding the original comment The listed failures ran against older revisions; their removed-helper/bootstrap and stale-fixture causes are fixed, and latest main has now been merged with regenerated locks and combined local validation. Final-head CI confirmation remains separate; no workflows were dispatched or rerun. |
|
Regarding the original comment The proposed runtime Go dependency and native helper have been removed: authored syntax is handled by the root compiler, while actions/setup consumes JSON headers without installing parser tooling. Boundary guards and deployment checks protect that separation, but maintainer review remains appropriate and team sign-off is not assumed. |
|
Regarding the original comment The assignment kickoff is already recorded, so no duplicate kickoff is needed. The historical failures have been investigated, latest main integrated, and the combined changes validated locally for CI and human review. |
Summary
work_queue_yaml.cjs, the replacement parser dependency, and the rejected native metadata helper and its provisioning/build wiring.actions/setup/. JavaScript reads bounded JSON metadata/manifest headers from.lock.ymlfiles through the shared lock-header reader; it does not parse the workflow body or install tools to interpret author syntax.aw_info.json. Missing or stale compiler metadata fails explicitly; sources must provide precompiled metadata, not a runtime parsing fallback.scripts/, outside the deployed Actions runtime.Validation
make agent-report-progresspassed: build, Go/custom/JavaScript lint, schema freshness, impacted Go tests, workflow drift checks, 2,416 setup JavaScript tests, and 721 ESLint-factory tests.No Go compiler, native metadata executable, or parsing package is provisioned by the setup runtime.