From 31a21bf2f7d3c77391933f11b28792983a9cc6ae Mon Sep 17 00:00:00 2001 From: pelikhan Date: Sun, 8 Nov 2026 19:23:50 -0800 Subject: [PATCH 1/2] fix: collect activation metadata in unified workflow sessions Download the existing info artifact in conclusion before restoring runtime model metadata. Preserve reusable workflow artifact prefixes and verify Kiro metadata publication under the existing workflow.info contract. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../patch-conclusion-workflow-metadata.md | 5 +++ .github/workflows/ab-testing-advisor.lock.yml | 7 ++++ .github/workflows/ace-editor.lock.yml | 7 ++++ .../actions-aw-linter-factory.lock.yml | 7 ++++ .github/workflows/agent-job-health.lock.yml | 7 ++++ .../agent-performance-analyzer.lock.yml | 7 ++++ .../workflows/agent-persona-explorer.lock.yml | 7 ++++ .../workflows/agentic-token-audit.lock.yml | 7 ++++ .../agentic-token-optimizer.lock.yml | 7 ++++ .../agentic-token-trend-audit.lock.yml | 7 ++++ .../agy-conformance-reusable.lock.yml | 7 ++++ .github/workflows/ai-moderator.lock.yml | 7 ++++ .../workflows/api-consumption-report.lock.yml | 7 ++++ .github/workflows/approach-validator.lock.yml | 7 ++++ .github/workflows/archie.lock.yml | 7 ++++ .../workflows/architecture-guardian.lock.yml | 7 ++++ ...rchivx-agentic-workflows-analyzer.lock.yml | 7 ++++ .github/workflows/artifacts-summary.lock.yml | 7 ++++ .github/workflows/audit-workflows.lock.yml | 7 ++++ .github/workflows/auditor.lock.yml | 7 ++++ .github/workflows/auto-triage-issues.lock.yml | 7 ++++ .github/workflows/avenger.lock.yml | 7 ++++ .../aw-failure-investigator.lock.yml | 7 ++++ .../workflows/aw-issue-clustering.lock.yml | 7 ++++ .github/workflows/blog-auditor.lock.yml | 7 ++++ .github/workflows/bot-detection.lock.yml | 7 ++++ .../breaking-change-checker.lock.yml | 7 ++++ .github/workflows/changeset.lock.yml | 7 ++++ .../workflows/chaos-pr-bundle-fuzzer.lock.yml | 7 ++++ .github/workflows/ci-coach.lock.yml | 7 ++++ .../claude-code-user-docs-review.lock.yml | 7 ++++ .../cli-consistency-checker.lock.yml | 7 ++++ .../workflows/cli-version-checker.lock.yml | 7 ++++ .github/workflows/cloclo.lock.yml | 7 ++++ .../workflows/code-scanning-fixer.lock.yml | 7 ++++ .github/workflows/code-simplifier.lock.yml | 7 ++++ .../codex-github-remote-mcp-test.lock.yml | 7 ++++ .../commit-changes-analyzer.lock.yml | 7 ++++ .../constraint-solving-potd.lock.yml | 7 ++++ .github/workflows/contribution-check.lock.yml | 7 ++++ .../workflows/copilot-agent-analysis.lock.yml | 7 ++++ .../copilot-centralization-drilldown.lock.yml | 7 ++++ .../copilot-centralization-optimizer.lock.yml | 7 ++++ .../copilot-cli-deep-research.lock.yml | 7 ++++ .github/workflows/copilot-opt.lock.yml | 7 ++++ .../copilot-pr-merged-report.lock.yml | 7 ++++ .../copilot-pr-nlp-analysis.lock.yml | 7 ++++ .../copilot-pr-prompt-analysis.lock.yml | 7 ++++ .../copilot-session-insights.lock.yml | 7 ++++ .github/workflows/craft.lock.yml | 7 ++++ ...daily-action-setup-security-audit.lock.yml | 7 ++++ ...aily-agent-of-the-day-blog-writer.lock.yml | 7 ++++ .../daily-agentrx-trace-optimizer.lock.yml | 7 ++++ .../daily-ambient-context-optimizer.lock.yml | 7 ++++ .../daily-architecture-diagram.lock.yml | 7 ++++ .../workflows/daily-arxiv-researcher.lock.yml | 7 ++++ .../daily-assign-issue-to-user.lock.yml | 7 ++++ ...strostylelite-markdown-spellcheck.lock.yml | 7 ++++ ...daily-aw-cross-repo-compile-check.lock.yml | 7 ++++ ...daily-awf-spec-compiler-surfacing.lock.yml | 7 ++++ .../workflows/daily-byok-ollama-test.lock.yml | 7 ++++ .../daily-cache-strategy-analyzer.lock.yml | 7 ++++ .../daily-caveman-optimizer.lock.yml | 7 ++++ .github/workflows/daily-choice-test.lock.yml | 7 ++++ .../workflows/daily-cli-performance.lock.yml | 7 ++++ .../workflows/daily-cli-tools-tester.lock.yml | 7 ++++ .../workflows/daily-code-debt-aider.lock.yml | 7 ++++ .github/workflows/daily-code-metrics.lock.yml | 7 ++++ .../daily-community-attribution.lock.yml | 7 ++++ .../workflows/daily-compiler-quality.lock.yml | 7 ++++ ...ly-compiler-threat-spec-optimizer.lock.yml | 7 ++++ .../daily-credit-limit-test.lock.yml | 7 ++++ ...daily-declarative-engine-improver.lock.yml | 7 ++++ .github/workflows/daily-doc-healer.lock.yml | 7 ++++ .github/workflows/daily-doc-updater.lock.yml | 7 ++++ .../daily-documentation-diagram.lock.yml | 7 ++++ .../daily-ecosystem-explorer.lock.yml | 7 ++++ .../daily-elixir-credo-snippet-audit.lock.yml | 7 ++++ .github/workflows/daily-evals-report.lock.yml | 7 ++++ .../daily-experiment-report.lock.yml | 7 ++++ .github/workflows/daily-fact.lock.yml | 7 ++++ .github/workflows/daily-file-diet.lock.yml | 7 ++++ .../workflows/daily-firewall-report.lock.yml | 7 ++++ .../daily-formal-spec-verifier.lock.yml | 7 ++++ .../workflows/daily-function-namer.lock.yml | 7 ++++ .../workflows/daily-geo-optimizer.lock.yml | 7 ++++ .../daily-github-docs-seo-optimizer.lock.yml | 7 ++++ .../daily-go-test-parallelizer.lock.yml | 7 ++++ .../daily-go-test-stubs-aider.lock.yml | 7 ++++ .github/workflows/daily-grader-audit.lock.yml | 7 ++++ .../daily-graft-intelligence.lock.yml | 7 ++++ ...daily-harness-experiment-proposer.lock.yml | 7 ++++ .github/workflows/daily-hippo-learn.lock.yml | 7 ++++ .../workflows/daily-issues-report.lock.yml | 7 ++++ .../daily-malicious-code-scan.lock.yml | 7 ++++ .../daily-max-ai-credits-test.lock.yml | 7 ++++ .../daily-mcp-concurrency-analysis.lock.yml | 7 ++++ .../workflows/daily-model-inventory.lock.yml | 7 ++++ .../workflows/daily-model-resolution.lock.yml | 7 ++++ .../daily-multi-device-docs-tester.lock.yml | 7 ++++ .github/workflows/daily-news.lock.yml | 7 ++++ .../daily-observability-report.lock.yml | 7 ++++ .../daily-performance-summary.lock.yml | 7 ++++ .../workflows/daily-pr-review-cursor.lock.yml | 7 ++++ .../daily-regression-audit-kiro.lock.yml | 7 ++++ .github/workflows/daily-regulatory.lock.yml | 7 ++++ .../daily-reliability-review.lock.yml | 7 ++++ .../daily-rendering-scripts-verifier.lock.yml | 7 ++++ .../workflows/daily-repo-chronicle.lock.yml | 7 ++++ .../daily-report-dispatcher.lock.yml | 7 ++++ .../daily-safe-output-integrator.lock.yml | 7 ++++ .../daily-safe-output-optimizer.lock.yml | 7 ++++ .../daily-safe-outputs-conformance.lock.yml | 7 ++++ .../daily-safeoutputs-git-simulator.lock.yml | 7 ++++ .../daily-schema-audit-cursor.lock.yml | 7 ++++ .../workflows/daily-secrets-analysis.lock.yml | 7 ++++ .../daily-security-observability.lock.yml | 7 ++++ .../daily-security-red-team.lock.yml | 7 ++++ .github/workflows/daily-semgrep-scan.lock.yml | 7 ++++ .../daily-spdd-spec-planner.lock.yml | 7 ++++ .../daily-spec-coverage-kiro.lock.yml | 7 ++++ .../daily-spending-forecast.lock.yml | 7 ++++ .../workflows/daily-squid-image-scan.lock.yml | 7 ++++ .github/workflows/daily-storify.lock.yml | 7 ++++ .../daily-syntax-error-quality.lock.yml | 7 ++++ .../daily-team-evolution-insights.lock.yml | 7 ++++ .github/workflows/daily-team-status.lock.yml | 7 ++++ .../daily-testify-uber-super-expert.lock.yml | 7 ++++ .../workflows/daily-tlc-test-expert.lock.yml | 7 ++++ .../daily-token-consumption-report.lock.yml | 7 ++++ ...ily-trajectory-grader-implementer.lock.yml | 7 ++++ .../workflows/daily-vulnhunter-scan.lock.yml | 7 ++++ .../daily-windows-defender-scan.lock.yml | 7 ++++ ...dows-terminal-integration-builder.lock.yml | 7 ++++ ...ly-work-queue-formal-verification.lock.yml | 7 ++++ .../daily-work-queues-report.lock.yml | 7 ++++ .../daily-workflow-security-model.lock.yml | 7 ++++ .../workflows/daily-workflow-updater.lock.yml | 7 ++++ .../workflows/daily-yamllint-fixer.lock.yml | 7 ++++ .../dataflow-pr-discussion-dataset.lock.yml | 7 ++++ .github/workflows/dead-code-remover.lock.yml | 7 ++++ .github/workflows/deep-report.lock.yml | 7 ++++ .../workflows/deepsec-security-scan.lock.yml | 7 ++++ .github/workflows/delight.lock.yml | 7 ++++ .github/workflows/dependabot-burner.lock.yml | 7 ++++ .../workflows/dependabot-go-checker.lock.yml | 7 ++++ .../deployment-incident-monitor.lock.yml | 7 ++++ .../workflows/design-decision-gate.lock.yml | 7 ++++ .../workflows/designer-drift-audit.lock.yml | 7 ++++ .../detection-analysis-report.lock.yml | 7 ++++ .github/workflows/dev-hawk.lock.yml | 7 ++++ .github/workflows/dev.lock.yml | 7 ++++ .../developer-docs-consolidator.lock.yml | 7 ++++ .github/workflows/dictation-prompt.lock.yml | 7 ++++ .github/workflows/docs-noob-tester.lock.yml | 7 ++++ .github/workflows/draft-pr-cleanup.lock.yml | 7 ++++ .../duplicate-code-detector.lock.yml | 7 ++++ .../workflows/engine-conformance-agy.lock.yml | 7 ++++ .../engine-conformance-aider.lock.yml | 7 ++++ .../engine-conformance-atomic.lock.yml | 7 ++++ .../engine-conformance-claude.lock.yml | 7 ++++ .../engine-conformance-codex.lock.yml | 7 ++++ .../engine-conformance-copilot.lock.yml | 7 ++++ .../engine-conformance-crush.lock.yml | 7 ++++ .../engine-conformance-cursor.lock.yml | 7 ++++ ...gine-conformance-deepseek-harness.lock.yml | 7 ++++ .../engine-conformance-dispatcher.lock.yml | 7 ++++ .../engine-conformance-factory.lock.yml | 7 ++++ .../engine-conformance-gemini.lock.yml | 7 ++++ .../engine-conformance-goose.lock.yml | 7 ++++ .../engine-conformance-kiro.lock.yml | 7 ++++ ...engine-conformance-mini-swe-agent.lock.yml | 7 ++++ .../engine-conformance-opencode.lock.yml | 7 ++++ .../workflows/engine-conformance-pi.lock.yml | 7 ++++ .../engine-conformance-pydantic-ai.lock.yml | 7 ++++ .../workflows/enterprise-docs-audit.lock.yml | 7 ++++ .../eslint-factory-dispatcher.lock.yml | 7 ++++ .github/workflows/eslint-miner.lock.yml | 7 ++++ .github/workflows/eslint-monster.lock.yml | 7 ++++ .github/workflows/eslint-refiner.lock.yml | 7 ++++ .github/workflows/evoskill-evolver.lock.yml | 7 ++++ .../example-failure-category-filter.lock.yml | 7 ++++ .../example-permissions-warning.lock.yml | 7 ++++ .../example-workflow-analyzer.lock.yml | 7 ++++ .github/workflows/feature-grower.lock.yml | 7 ++++ .github/workflows/firewall-escape.lock.yml | 7 ++++ .github/workflows/firewall.lock.yml | 7 ++++ .../workflows/front-page-copy-guard.lock.yml | 7 ++++ .../workflows/functional-pragmatist.lock.yml | 7 ++++ .../github-mcp-structural-analysis.lock.yml | 7 ++++ .../github-mcp-tools-report.lock.yml | 7 ++++ .../github-remote-mcp-auth-test.lock.yml | 7 ++++ .../workflows/glossary-maintainer.lock.yml | 7 ++++ .github/workflows/go-fan.lock.yml | 7 ++++ .github/workflows/go-logger.lock.yml | 7 ++++ .../workflows/go-pattern-detector.lock.yml | 7 ++++ .github/workflows/gpclean.lock.yml | 7 ++++ .github/workflows/grumpy-reviewer.lock.yml | 7 ++++ .github/workflows/hippo-embed.lock.yml | 7 ++++ .github/workflows/hourly-ci-cleaner.lock.yml | 7 ++++ .../impeccable-skills-reviewer.lock.yml | 7 ++++ .../workflows/instructions-janitor.lock.yml | 7 ++++ .github/workflows/issue-arborist.lock.yml | 7 ++++ .github/workflows/issue-monster.lock.yml | 7 ++++ .github/workflows/issue-triage-agent.lock.yml | 7 ++++ .github/workflows/jsweep.lock.yml | 7 ++++ .../workflows/layout-spec-maintainer.lock.yml | 7 ++++ .github/workflows/lint-monster.lock.yml | 7 ++++ .github/workflows/linter-miner.lock.yml | 7 ++++ .github/workflows/lockfile-stats.lock.yml | 7 ++++ .../mattpocock-skills-reviewer.lock.yml | 7 ++++ .github/workflows/mcp-inspector.lock.yml | 7 ++++ .github/workflows/mergefest.lock.yml | 7 ++++ .github/workflows/metrics-collector.lock.yml | 7 ++++ .github/workflows/necromancer.lock.yml | 7 ++++ .../workflows/notion-issue-summary.lock.yml | 7 ++++ .../objective-impact-report.lock.yml | 7 ++++ .github/workflows/org-health-report.lock.yml | 7 ++++ .github/workflows/pdf-summary.lock.yml | 7 ++++ .github/workflows/plan.lock.yml | 7 ++++ .github/workflows/poem-bot.lock.yml | 7 ++++ .github/workflows/ponytail-reviewer.lock.yml | 7 ++++ .github/workflows/portfolio-analyst.lock.yml | 7 ++++ .../pr-code-quality-reviewer.lock.yml | 7 ++++ .../workflows/pr-description-caveman.lock.yml | 7 ++++ .github/workflows/pr-finisher.lock.yml | 7 ++++ .../workflows/pr-nitpick-reviewer.lock.yml | 7 ++++ .github/workflows/pr-sous-chef.lock.yml | 7 ++++ .../pr-specification-reviewer.lock.yml | 7 ++++ .github/workflows/pr-triage-agent.lock.yml | 7 ++++ .../prompt-clustering-analysis.lock.yml | 7 ++++ .github/workflows/purelock.lock.yml | 7 ++++ .github/workflows/python-data-charts.lock.yml | 7 ++++ .github/workflows/q.lock.yml | 7 ++++ .../workflows/refactoring-cadence.lock.yml | 7 ++++ .github/workflows/refiner.lock.yml | 7 ++++ .github/workflows/release.lock.yml | 7 ++++ .../workflows/repo-audit-analyzer.lock.yml | 7 ++++ .github/workflows/repo-tree-map.lock.yml | 7 ++++ .../repository-quality-improver.lock.yml | 7 ++++ .github/workflows/research.lock.yml | 7 ++++ .github/workflows/safe-output-health.lock.yml | 7 ++++ .../schema-consistency-checker.lock.yml | 7 ++++ .../schema-feature-coverage.lock.yml | 7 ++++ .github/workflows/scout.lock.yml | 7 ++++ .../workflows/security-compliance.lock.yml | 7 ++++ .github/workflows/security-review.lock.yml | 7 ++++ .../semantic-function-refactor.lock.yml | 7 ++++ .github/workflows/sergo.lock.yml | 7 ++++ .../sighthound-security-scan.lock.yml | 7 ++++ .github/workflows/skillet.lock.yml | 7 ++++ .../workflows/slide-deck-maintainer.lock.yml | 7 ++++ .../workflows/smoke-agent-all-merged.lock.yml | 7 ++++ .../workflows/smoke-agent-all-none.lock.yml | 7 ++++ .../smoke-agent-public-approved.lock.yml | 7 ++++ .../smoke-agent-public-none.lock.yml | 7 ++++ .../smoke-agent-scoped-approved.lock.yml | 7 ++++ .github/workflows/smoke-agy.lock.yml | 7 ++++ .github/workflows/smoke-aider.lock.yml | 7 ++++ .github/workflows/smoke-atomic.lock.yml | 7 ++++ .github/workflows/smoke-azure-codex.lock.yml | 7 ++++ .github/workflows/smoke-azure-pi.lock.yml | 7 ++++ .../workflows/smoke-builtin-ledgers.lock.yml | 7 ++++ .../workflows/smoke-call-workflow.lock.yml | 7 ++++ .../smoke-checkout-pr-dispatch.lock.yml | 7 ++++ .github/workflows/smoke-ci.lock.yml | 7 ++++ .github/workflows/smoke-claude-auto.lock.yml | 7 ++++ .../smoke-claude-copilot-auto.lock.yml | 7 ++++ .../workflows/smoke-claude-copilot.lock.yml | 7 ++++ .../workflows/smoke-claude-dynamic.lock.yml | 7 ++++ .../smoke-claude-on-copilot.lock.yml | 7 ++++ .../smoke-claude-routed-anthropic.lock.yml | 7 ++++ .../workflows/smoke-claude-routed.lock.yml | 7 ++++ .../smoke-claude-sub-agents.lock.yml | 7 ++++ .github/workflows/smoke-claude.lock.yml | 7 ++++ .github/workflows/smoke-codex-auto.lock.yml | 7 ++++ .../workflows/smoke-codex-bare-auto.lock.yml | 7 ++++ .../smoke-codex-routed-openai.lock.yml | 7 ++++ .github/workflows/smoke-codex-routed.lock.yml | 7 ++++ .github/workflows/smoke-codex.lock.yml | 7 ++++ .../smoke-copilot-aoai-apikey.lock.yml | 7 ++++ .../smoke-copilot-aoai-entra.lock.yml | 7 ++++ .github/workflows/smoke-copilot-arm.lock.yml | 7 ++++ .github/workflows/smoke-copilot-auto.lock.yml | 7 ++++ .../smoke-copilot-dynamic-workflow.lock.yml | 7 ++++ .github/workflows/smoke-copilot-mai.lock.yml | 7 ++++ .../smoke-copilot-routed-claude.lock.yml | 7 ++++ .../smoke-copilot-routed-steering.lock.yml | 7 ++++ .../workflows/smoke-copilot-routed.lock.yml | 7 ++++ .../smoke-copilot-sdk-routed-claude.lock.yml | 7 ++++ .../smoke-copilot-sdk-routed.lock.yml | 7 ++++ .github/workflows/smoke-copilot-sdk.lock.yml | 7 ++++ .../workflows/smoke-copilot-small.lock.yml | 7 ++++ .../smoke-copilot-sub-agents.lock.yml | 7 ++++ .github/workflows/smoke-copilot.lock.yml | 7 ++++ .../smoke-create-cross-repo-pr.lock.yml | 7 ++++ .github/workflows/smoke-crush.lock.yml | 7 ++++ .github/workflows/smoke-cursor.lock.yml | 7 ++++ .../workflows/smoke-deepseek-harness.lock.yml | 7 ++++ .github/workflows/smoke-drive.lock.yml | 7 ++++ .github/workflows/smoke-factory.lock.yml | 7 ++++ .github/workflows/smoke-gemini.lock.yml | 7 ++++ .../workflows/smoke-github-claude.lock.yml | 7 ++++ .github/workflows/smoke-github-codex.lock.yml | 7 ++++ .github/workflows/smoke-goose.lock.yml | 7 ++++ .github/workflows/smoke-issues.lock.yml | 7 ++++ .github/workflows/smoke-kiro.lock.yml | 7 ++++ .../workflows/smoke-mini-swe-agent.lock.yml | 7 ++++ .github/workflows/smoke-multi-pr.lock.yml | 7 ++++ .github/workflows/smoke-opencode.lock.yml | 7 ++++ .../workflows/smoke-otel-backends.lock.yml | 7 ++++ .github/workflows/smoke-pi-auto.lock.yml | 7 ++++ .../workflows/smoke-pi-routed-claude.lock.yml | 7 ++++ .github/workflows/smoke-pi-routed.lock.yml | 7 ++++ .../workflows/smoke-pi-sub-agents.lock.yml | 7 ++++ .github/workflows/smoke-pi.lock.yml | 7 ++++ .github/workflows/smoke-project.lock.yml | 7 ++++ .github/workflows/smoke-pydantic.lock.yml | 7 ++++ .../smoke-repo-memory-ledger.lock.yml | 7 ++++ .../workflows/smoke-security-alerts.lock.yml | 7 ++++ .../workflows/smoke-service-ports.lock.yml | 7 ++++ .github/workflows/smoke-temporary-id.lock.yml | 7 ++++ .github/workflows/smoke-test-tools.lock.yml | 7 ++++ .../smoke-update-cross-repo-pr.lock.yml | 7 ++++ .../smoke-work-queue-dispatcher.lock.yml | 7 ++++ .../smoke-work-queue-worker.lock.yml | 7 ++++ .github/workflows/smoke-work-queue.lock.yml | 7 ++++ .../smoke-workflow-call-with-inputs.lock.yml | 7 ++++ .../workflows/smoke-workflow-call.lock.yml | 7 ++++ .github/workflows/spec-enforcer.lock.yml | 7 ++++ .github/workflows/spec-extractor.lock.yml | 7 ++++ .github/workflows/spec-librarian.lock.yml | 7 ++++ .github/workflows/squad-game-planner.lock.yml | 7 ++++ .../workflows/squad-implement-worker.lock.yml | 7 ++++ .github/workflows/squad-plan.lock.yml | 7 ++++ .github/workflows/squad.lock.yml | 7 ++++ .github/workflows/stale-pr-cleanup.lock.yml | 7 ++++ .../workflows/stale-repo-identifier.lock.yml | 7 ++++ .../workflows/static-analysis-report.lock.yml | 7 ++++ .../workflows/step-name-alignment.lock.yml | 7 ++++ .github/workflows/sub-issue-closer.lock.yml | 7 ++++ .github/workflows/super-linter.lock.yml | 7 ++++ .../workflows/technical-doc-writer.lock.yml | 7 ++++ .github/workflows/terminal-stylist.lock.yml | 7 ++++ .../workflows/test-quality-sentinel.lock.yml | 7 ++++ .github/workflows/tidy.lock.yml | 7 ++++ .github/workflows/typist.lock.yml | 7 ++++ .../workflows/ubuntu-image-analyzer.lock.yml | 7 ++++ .../uk-ai-operational-resilience.lock.yml | 7 ++++ .github/workflows/unbloat-docs.lock.yml | 7 ++++ .github/workflows/update-astro.lock.yml | 7 ++++ .github/workflows/video-analyzer.lock.yml | 7 ++++ .../visual-regression-checker.lock.yml | 7 ++++ .../weekly-blog-post-writer.lock.yml | 7 ++++ .../weekly-editors-health-check.lock.yml | 7 ++++ .../weekly-git-simulator-dreaming.lock.yml | 7 ++++ .../workflows/weekly-issue-summary.lock.yml | 7 ++++ .../weekly-network-domains-audit.lock.yml | 7 ++++ .../workflows/weekly-otel-reference.lock.yml | 7 ++++ .../weekly-safe-outputs-spec-review.lock.yml | 7 ++++ .github/workflows/windows-grower.lock.yml | 7 ++++ .github/workflows/windows.lock.yml | 7 ++++ .github/workflows/workflow-generator.lock.yml | 7 ++++ .../workflow-health-manager.lock.yml | 7 ++++ .../workflows/workflow-normalizer.lock.yml | 7 ++++ .../workflow-skill-extractor.lock.yml | 7 ++++ actions/setup/js/unified_session.test.cjs | 37 ++++++++++++++++++ .../unified-agent-session-specification.md | 6 ++- .../notify_comment_conclusion_helpers.go | 1 + pkg/workflow/safe_outputs_steps.go | 9 +++++ pkg/workflow/unified_session_artifact_test.go | 39 +++++++++++++++++++ 371 files changed, 2651 insertions(+), 1 deletion(-) create mode 100644 .changeset/patch-conclusion-workflow-metadata.md diff --git a/.changeset/patch-conclusion-workflow-metadata.md b/.changeset/patch-conclusion-workflow-metadata.md new file mode 100644 index 00000000000..394e7b392c4 --- /dev/null +++ b/.changeset/patch-conclusion-workflow-metadata.md @@ -0,0 +1,5 @@ +--- +"gh-aw": patch +--- + +Download activation's workflow metadata in conclusion so unified sessions retain available engine, model, version, revision, and trigger information. diff --git a/.github/workflows/ab-testing-advisor.lock.yml b/.github/workflows/ab-testing-advisor.lock.yml index b67546df7f2..47ed8ac05a5 100644 --- a/.github/workflows/ab-testing-advisor.lock.yml +++ b/.github/workflows/ab-testing-advisor.lock.yml @@ -1641,6 +1641,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/ace-editor.lock.yml b/.github/workflows/ace-editor.lock.yml index 4f6abc7decd..696817027f8 100644 --- a/.github/workflows/ace-editor.lock.yml +++ b/.github/workflows/ace-editor.lock.yml @@ -1473,6 +1473,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/actions-aw-linter-factory.lock.yml b/.github/workflows/actions-aw-linter-factory.lock.yml index 8f7568e8e38..1b29a647aa6 100644 --- a/.github/workflows/actions-aw-linter-factory.lock.yml +++ b/.github/workflows/actions-aw-linter-factory.lock.yml @@ -1639,6 +1639,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agent-job-health.lock.yml b/.github/workflows/agent-job-health.lock.yml index 8baaf4521db..2facf4d1dbe 100644 --- a/.github/workflows/agent-job-health.lock.yml +++ b/.github/workflows/agent-job-health.lock.yml @@ -1814,6 +1814,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml index 781a1faf24b..55c53e692af 100644 --- a/.github/workflows/agent-performance-analyzer.lock.yml +++ b/.github/workflows/agent-performance-analyzer.lock.yml @@ -1865,6 +1865,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml index d1f9136faca..410cf4f58ce 100644 --- a/.github/workflows/agent-persona-explorer.lock.yml +++ b/.github/workflows/agent-persona-explorer.lock.yml @@ -1724,6 +1724,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agentic-token-audit.lock.yml b/.github/workflows/agentic-token-audit.lock.yml index 72c83bb0677..86a3bfa120f 100644 --- a/.github/workflows/agentic-token-audit.lock.yml +++ b/.github/workflows/agentic-token-audit.lock.yml @@ -1768,6 +1768,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agentic-token-optimizer.lock.yml b/.github/workflows/agentic-token-optimizer.lock.yml index 3e439396289..0b403e88c4e 100644 --- a/.github/workflows/agentic-token-optimizer.lock.yml +++ b/.github/workflows/agentic-token-optimizer.lock.yml @@ -1628,6 +1628,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/agentic-token-trend-audit.lock.yml b/.github/workflows/agentic-token-trend-audit.lock.yml index f4f9b3a1bfb..b798d005613 100644 --- a/.github/workflows/agentic-token-trend-audit.lock.yml +++ b/.github/workflows/agentic-token-trend-audit.lock.yml @@ -1656,6 +1656,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/agy-conformance-reusable.lock.yml b/.github/workflows/agy-conformance-reusable.lock.yml index 9f6d8277ad1..6e4207fd24d 100644 --- a/.github/workflows/agy-conformance-reusable.lock.yml +++ b/.github/workflows/agy-conformance-reusable.lock.yml @@ -1659,6 +1659,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: ${{ needs.activation.outputs.artifact_prefix }}info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml index 4256ae28cdd..6fc0dd24625 100644 --- a/.github/workflows/ai-moderator.lock.yml +++ b/.github/workflows/ai-moderator.lock.yml @@ -1643,6 +1643,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/api-consumption-report.lock.yml b/.github/workflows/api-consumption-report.lock.yml index 4124b8d282c..b568ed28e1d 100644 --- a/.github/workflows/api-consumption-report.lock.yml +++ b/.github/workflows/api-consumption-report.lock.yml @@ -1968,6 +1968,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/approach-validator.lock.yml b/.github/workflows/approach-validator.lock.yml index 7ccce4ef6e9..f4a463bc9c4 100644 --- a/.github/workflows/approach-validator.lock.yml +++ b/.github/workflows/approach-validator.lock.yml @@ -1769,6 +1769,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml index caa13bb3d75..3df7f37cd96 100644 --- a/.github/workflows/archie.lock.yml +++ b/.github/workflows/archie.lock.yml @@ -1690,6 +1690,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/architecture-guardian.lock.yml b/.github/workflows/architecture-guardian.lock.yml index cb425641afc..4b0885b34f4 100644 --- a/.github/workflows/architecture-guardian.lock.yml +++ b/.github/workflows/architecture-guardian.lock.yml @@ -1617,6 +1617,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml b/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml index b53ee0b55b6..05cae6c48fc 100644 --- a/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml +++ b/.github/workflows/archivx-agentic-workflows-analyzer.lock.yml @@ -1817,6 +1817,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml index 8122aa976e8..522e3250904 100644 --- a/.github/workflows/artifacts-summary.lock.yml +++ b/.github/workflows/artifacts-summary.lock.yml @@ -1610,6 +1610,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml index 3a0af626f4c..912412f81f8 100644 --- a/.github/workflows/audit-workflows.lock.yml +++ b/.github/workflows/audit-workflows.lock.yml @@ -1909,6 +1909,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/auditor.lock.yml b/.github/workflows/auditor.lock.yml index bfc3a63753d..70566b863b4 100644 --- a/.github/workflows/auditor.lock.yml +++ b/.github/workflows/auditor.lock.yml @@ -1885,6 +1885,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml index 04cf209198f..1a5db07cf3a 100644 --- a/.github/workflows/auto-triage-issues.lock.yml +++ b/.github/workflows/auto-triage-issues.lock.yml @@ -1678,6 +1678,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml index 117bcaa1252..462d06a19a2 100644 --- a/.github/workflows/avenger.lock.yml +++ b/.github/workflows/avenger.lock.yml @@ -1742,6 +1742,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/aw-failure-investigator.lock.yml b/.github/workflows/aw-failure-investigator.lock.yml index 4c9070f6ff5..a733c390d9f 100644 --- a/.github/workflows/aw-failure-investigator.lock.yml +++ b/.github/workflows/aw-failure-investigator.lock.yml @@ -1883,6 +1883,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/aw-issue-clustering.lock.yml b/.github/workflows/aw-issue-clustering.lock.yml index 9c8d5898b76..b190282bab2 100644 --- a/.github/workflows/aw-issue-clustering.lock.yml +++ b/.github/workflows/aw-issue-clustering.lock.yml @@ -1549,6 +1549,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml index a4ba0eace6c..3f3ff0bfd5e 100644 --- a/.github/workflows/blog-auditor.lock.yml +++ b/.github/workflows/blog-auditor.lock.yml @@ -1752,6 +1752,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml index f3c78c634f0..9baf3d75740 100644 --- a/.github/workflows/bot-detection.lock.yml +++ b/.github/workflows/bot-detection.lock.yml @@ -1628,6 +1628,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml index e2781228126..b97bbfcc960 100644 --- a/.github/workflows/breaking-change-checker.lock.yml +++ b/.github/workflows/breaking-change-checker.lock.yml @@ -1652,6 +1652,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml index 662b525e9c8..96313cd391d 100644 --- a/.github/workflows/changeset.lock.yml +++ b/.github/workflows/changeset.lock.yml @@ -1644,6 +1644,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml index e4f61e52932..1ef9f0dae16 100644 --- a/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml +++ b/.github/workflows/chaos-pr-bundle-fuzzer.lock.yml @@ -1630,6 +1630,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml index dbb2d98b968..963dd6cbe84 100644 --- a/.github/workflows/ci-coach.lock.yml +++ b/.github/workflows/ci-coach.lock.yml @@ -1770,6 +1770,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml index 1256f5d085a..d4ecb6f8c8d 100644 --- a/.github/workflows/claude-code-user-docs-review.lock.yml +++ b/.github/workflows/claude-code-user-docs-review.lock.yml @@ -1661,6 +1661,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml index 90af5232ae7..8d973318bef 100644 --- a/.github/workflows/cli-consistency-checker.lock.yml +++ b/.github/workflows/cli-consistency-checker.lock.yml @@ -1574,6 +1574,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml index 566cc445b1d..230748dc4e0 100644 --- a/.github/workflows/cli-version-checker.lock.yml +++ b/.github/workflows/cli-version-checker.lock.yml @@ -1625,6 +1625,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 118f6344883..d29d52ac7b5 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -1977,6 +1977,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml index 6301464bc44..10e27f07a98 100644 --- a/.github/workflows/code-scanning-fixer.lock.yml +++ b/.github/workflows/code-scanning-fixer.lock.yml @@ -1810,6 +1810,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml index 03c57343d47..b37385b09c5 100644 --- a/.github/workflows/code-simplifier.lock.yml +++ b/.github/workflows/code-simplifier.lock.yml @@ -1659,6 +1659,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/codex-github-remote-mcp-test.lock.yml b/.github/workflows/codex-github-remote-mcp-test.lock.yml index 19e82fac57d..a70034f84b1 100644 --- a/.github/workflows/codex-github-remote-mcp-test.lock.yml +++ b/.github/workflows/codex-github-remote-mcp-test.lock.yml @@ -1421,6 +1421,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml index 6a7c44cd9d0..bfa4fae9bd4 100644 --- a/.github/workflows/commit-changes-analyzer.lock.yml +++ b/.github/workflows/commit-changes-analyzer.lock.yml @@ -1594,6 +1594,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml index 91d80604e5f..cc367df7246 100644 --- a/.github/workflows/constraint-solving-potd.lock.yml +++ b/.github/workflows/constraint-solving-potd.lock.yml @@ -1597,6 +1597,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml index 38dbb6499c8..cec4a3db035 100644 --- a/.github/workflows/contribution-check.lock.yml +++ b/.github/workflows/contribution-check.lock.yml @@ -1775,6 +1775,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml index 362faeea7b6..b09c489f8d6 100644 --- a/.github/workflows/copilot-agent-analysis.lock.yml +++ b/.github/workflows/copilot-agent-analysis.lock.yml @@ -1818,6 +1818,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/copilot-centralization-drilldown.lock.yml b/.github/workflows/copilot-centralization-drilldown.lock.yml index f245ad409c7..152839f1303 100644 --- a/.github/workflows/copilot-centralization-drilldown.lock.yml +++ b/.github/workflows/copilot-centralization-drilldown.lock.yml @@ -1545,6 +1545,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/copilot-centralization-optimizer.lock.yml b/.github/workflows/copilot-centralization-optimizer.lock.yml index a03fac8c6df..160a51c305f 100644 --- a/.github/workflows/copilot-centralization-optimizer.lock.yml +++ b/.github/workflows/copilot-centralization-optimizer.lock.yml @@ -1772,6 +1772,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml index 2d6f3f8f3a5..bf92b6253ec 100644 --- a/.github/workflows/copilot-cli-deep-research.lock.yml +++ b/.github/workflows/copilot-cli-deep-research.lock.yml @@ -1704,6 +1704,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-opt.lock.yml b/.github/workflows/copilot-opt.lock.yml index bae3c6bbefb..831b17a383d 100644 --- a/.github/workflows/copilot-opt.lock.yml +++ b/.github/workflows/copilot-opt.lock.yml @@ -1660,6 +1660,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml index a7c41d66387..d6a573d1d05 100644 --- a/.github/workflows/copilot-pr-merged-report.lock.yml +++ b/.github/workflows/copilot-pr-merged-report.lock.yml @@ -1511,6 +1511,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml index 33871a2568a..6cec20bdf73 100644 --- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml +++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml @@ -1853,6 +1853,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml index 52e492d8e88..a967cdf322f 100644 --- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml +++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml @@ -1730,6 +1730,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml index 9e7b782498c..82982ba032c 100644 --- a/.github/workflows/copilot-session-insights.lock.yml +++ b/.github/workflows/copilot-session-insights.lock.yml @@ -1823,6 +1823,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml index faa3b0814d2..51f48b7ff72 100644 --- a/.github/workflows/craft.lock.yml +++ b/.github/workflows/craft.lock.yml @@ -1629,6 +1629,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-action-setup-security-audit.lock.yml b/.github/workflows/daily-action-setup-security-audit.lock.yml index 18c6e747573..cd47fcc6cff 100644 --- a/.github/workflows/daily-action-setup-security-audit.lock.yml +++ b/.github/workflows/daily-action-setup-security-audit.lock.yml @@ -1636,6 +1636,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml index b15e4f1dbb4..361004e571f 100644 --- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml +++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml @@ -1832,6 +1832,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml index 3a8947a5fef..5d73b0f63c0 100644 --- a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml +++ b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml @@ -1834,6 +1834,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-ambient-context-optimizer.lock.yml b/.github/workflows/daily-ambient-context-optimizer.lock.yml index 96f83c7d9f4..57187e5ded9 100644 --- a/.github/workflows/daily-ambient-context-optimizer.lock.yml +++ b/.github/workflows/daily-ambient-context-optimizer.lock.yml @@ -1644,6 +1644,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml index ad13159eb90..110ddb35f92 100644 --- a/.github/workflows/daily-architecture-diagram.lock.yml +++ b/.github/workflows/daily-architecture-diagram.lock.yml @@ -1772,6 +1772,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-arxiv-researcher.lock.yml b/.github/workflows/daily-arxiv-researcher.lock.yml index a857b7a2b78..e45d85b4415 100644 --- a/.github/workflows/daily-arxiv-researcher.lock.yml +++ b/.github/workflows/daily-arxiv-researcher.lock.yml @@ -1799,6 +1799,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml index e75ecf00707..987a57f6ede 100644 --- a/.github/workflows/daily-assign-issue-to-user.lock.yml +++ b/.github/workflows/daily-assign-issue-to-user.lock.yml @@ -1592,6 +1592,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml index 3ec2483f761..e2e5d444519 100644 --- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml +++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml @@ -1739,6 +1739,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml index 545f015e237..9806074a345 100644 --- a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml +++ b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml @@ -1665,6 +1665,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml index a286c3713ed..8be3507b905 100644 --- a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml +++ b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml @@ -1651,6 +1651,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-byok-ollama-test.lock.yml b/.github/workflows/daily-byok-ollama-test.lock.yml index 6608902fb68..da3ad27b7ea 100644 --- a/.github/workflows/daily-byok-ollama-test.lock.yml +++ b/.github/workflows/daily-byok-ollama-test.lock.yml @@ -1462,6 +1462,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-cache-strategy-analyzer.lock.yml b/.github/workflows/daily-cache-strategy-analyzer.lock.yml index 00e93ed5cc5..e8f745e4640 100644 --- a/.github/workflows/daily-cache-strategy-analyzer.lock.yml +++ b/.github/workflows/daily-cache-strategy-analyzer.lock.yml @@ -1757,6 +1757,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml index 3700c66ae04..a40be999290 100644 --- a/.github/workflows/daily-caveman-optimizer.lock.yml +++ b/.github/workflows/daily-caveman-optimizer.lock.yml @@ -2013,6 +2013,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml index 34edc2c7eb5..ab18dbea417 100644 --- a/.github/workflows/daily-choice-test.lock.yml +++ b/.github/workflows/daily-choice-test.lock.yml @@ -1569,6 +1569,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml index d9745dde91c..91021e778b9 100644 --- a/.github/workflows/daily-cli-performance.lock.yml +++ b/.github/workflows/daily-cli-performance.lock.yml @@ -1946,6 +1946,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml index 4839dbcb628..d97f3c88c1f 100644 --- a/.github/workflows/daily-cli-tools-tester.lock.yml +++ b/.github/workflows/daily-cli-tools-tester.lock.yml @@ -1637,6 +1637,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml index 027da44f5e0..223b085e718 100644 --- a/.github/workflows/daily-code-debt-aider.lock.yml +++ b/.github/workflows/daily-code-debt-aider.lock.yml @@ -2015,6 +2015,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml index 1345ae1c8d5..28e5f7087c5 100644 --- a/.github/workflows/daily-code-metrics.lock.yml +++ b/.github/workflows/daily-code-metrics.lock.yml @@ -1837,6 +1837,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml index afd5d42d06c..7decf43a6d7 100644 --- a/.github/workflows/daily-community-attribution.lock.yml +++ b/.github/workflows/daily-community-attribution.lock.yml @@ -1839,6 +1839,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml index e164a741ed1..a719d7b8ac2 100644 --- a/.github/workflows/daily-compiler-quality.lock.yml +++ b/.github/workflows/daily-compiler-quality.lock.yml @@ -1849,6 +1849,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml index a793d41cd95..f4cf1713bd3 100644 --- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml +++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml @@ -1680,6 +1680,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-credit-limit-test.lock.yml b/.github/workflows/daily-credit-limit-test.lock.yml index d2f6921cc8f..1e5bd1005a4 100644 --- a/.github/workflows/daily-credit-limit-test.lock.yml +++ b/.github/workflows/daily-credit-limit-test.lock.yml @@ -1510,6 +1510,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-declarative-engine-improver.lock.yml b/.github/workflows/daily-declarative-engine-improver.lock.yml index f271c37d77d..1530d3e6080 100644 --- a/.github/workflows/daily-declarative-engine-improver.lock.yml +++ b/.github/workflows/daily-declarative-engine-improver.lock.yml @@ -1658,6 +1658,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml index 52bad1e9dfd..723a7c7fce5 100644 --- a/.github/workflows/daily-doc-healer.lock.yml +++ b/.github/workflows/daily-doc-healer.lock.yml @@ -1858,6 +1858,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml index a894c85d210..f6a8965e669 100644 --- a/.github/workflows/daily-doc-updater.lock.yml +++ b/.github/workflows/daily-doc-updater.lock.yml @@ -1690,6 +1690,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml index c1719b48c27..1de23a9698b 100644 --- a/.github/workflows/daily-documentation-diagram.lock.yml +++ b/.github/workflows/daily-documentation-diagram.lock.yml @@ -1692,6 +1692,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-ecosystem-explorer.lock.yml b/.github/workflows/daily-ecosystem-explorer.lock.yml index 4d0bdb4cc9f..f543d03470a 100644 --- a/.github/workflows/daily-ecosystem-explorer.lock.yml +++ b/.github/workflows/daily-ecosystem-explorer.lock.yml @@ -1705,6 +1705,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml index 2c469770418..f0781016af4 100644 --- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml +++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml @@ -1654,6 +1654,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-evals-report.lock.yml b/.github/workflows/daily-evals-report.lock.yml index 11166fc6eea..850a3fd2e67 100644 --- a/.github/workflows/daily-evals-report.lock.yml +++ b/.github/workflows/daily-evals-report.lock.yml @@ -1669,6 +1669,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-experiment-report.lock.yml b/.github/workflows/daily-experiment-report.lock.yml index 2a979e94e7d..ebbb885f089 100644 --- a/.github/workflows/daily-experiment-report.lock.yml +++ b/.github/workflows/daily-experiment-report.lock.yml @@ -1710,6 +1710,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml index 992fc386527..71df67bf7d6 100644 --- a/.github/workflows/daily-fact.lock.yml +++ b/.github/workflows/daily-fact.lock.yml @@ -1686,6 +1686,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml index 4dcc384c40f..eb882b2aaa4 100644 --- a/.github/workflows/daily-file-diet.lock.yml +++ b/.github/workflows/daily-file-diet.lock.yml @@ -1663,6 +1663,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml index fb399911a36..c36fb83425f 100644 --- a/.github/workflows/daily-firewall-report.lock.yml +++ b/.github/workflows/daily-firewall-report.lock.yml @@ -1777,6 +1777,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-formal-spec-verifier.lock.yml b/.github/workflows/daily-formal-spec-verifier.lock.yml index 34f3e723d10..5633479b000 100644 --- a/.github/workflows/daily-formal-spec-verifier.lock.yml +++ b/.github/workflows/daily-formal-spec-verifier.lock.yml @@ -1816,6 +1816,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-function-namer.lock.yml b/.github/workflows/daily-function-namer.lock.yml index 55c425ee1de..eb4730c11d6 100644 --- a/.github/workflows/daily-function-namer.lock.yml +++ b/.github/workflows/daily-function-namer.lock.yml @@ -1670,6 +1670,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-geo-optimizer.lock.yml b/.github/workflows/daily-geo-optimizer.lock.yml index ca003e120b7..0fe913260e2 100644 --- a/.github/workflows/daily-geo-optimizer.lock.yml +++ b/.github/workflows/daily-geo-optimizer.lock.yml @@ -1590,6 +1590,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml index 89fd345cbdd..df096563bb4 100644 --- a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml +++ b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml @@ -1429,6 +1429,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml index 6b8a58ef56d..7a631e9610c 100644 --- a/.github/workflows/daily-go-test-parallelizer.lock.yml +++ b/.github/workflows/daily-go-test-parallelizer.lock.yml @@ -1654,6 +1654,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml index 882aa35c4ab..3398c3d4fea 100644 --- a/.github/workflows/daily-go-test-stubs-aider.lock.yml +++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml @@ -1986,6 +1986,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-grader-audit.lock.yml b/.github/workflows/daily-grader-audit.lock.yml index 921e6e00169..3aaf0749672 100644 --- a/.github/workflows/daily-grader-audit.lock.yml +++ b/.github/workflows/daily-grader-audit.lock.yml @@ -1637,6 +1637,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-graft-intelligence.lock.yml b/.github/workflows/daily-graft-intelligence.lock.yml index d77ba0b77cb..3bea355eb5e 100644 --- a/.github/workflows/daily-graft-intelligence.lock.yml +++ b/.github/workflows/daily-graft-intelligence.lock.yml @@ -1614,6 +1614,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-harness-experiment-proposer.lock.yml b/.github/workflows/daily-harness-experiment-proposer.lock.yml index 03d06d8c1f6..aa2764f5f92 100644 --- a/.github/workflows/daily-harness-experiment-proposer.lock.yml +++ b/.github/workflows/daily-harness-experiment-proposer.lock.yml @@ -1717,6 +1717,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/daily-hippo-learn.lock.yml b/.github/workflows/daily-hippo-learn.lock.yml index 60a3c9b1ea1..04afbc3c2d9 100644 --- a/.github/workflows/daily-hippo-learn.lock.yml +++ b/.github/workflows/daily-hippo-learn.lock.yml @@ -1735,6 +1735,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml index 4fb0976249a..40d50ab8340 100644 --- a/.github/workflows/daily-issues-report.lock.yml +++ b/.github/workflows/daily-issues-report.lock.yml @@ -1982,6 +1982,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml index 3b15eb3fe06..faee6cf8436 100644 --- a/.github/workflows/daily-malicious-code-scan.lock.yml +++ b/.github/workflows/daily-malicious-code-scan.lock.yml @@ -1589,6 +1589,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-max-ai-credits-test.lock.yml b/.github/workflows/daily-max-ai-credits-test.lock.yml index f727b92f8d4..1bf21ba8e92 100644 --- a/.github/workflows/daily-max-ai-credits-test.lock.yml +++ b/.github/workflows/daily-max-ai-credits-test.lock.yml @@ -1465,6 +1465,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml index f034b0ef4f5..4876e34d8f6 100644 --- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml +++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml @@ -1998,6 +1998,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml index 52975675309..21c9c35923c 100644 --- a/.github/workflows/daily-model-inventory.lock.yml +++ b/.github/workflows/daily-model-inventory.lock.yml @@ -1968,6 +1968,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-model-resolution.lock.yml b/.github/workflows/daily-model-resolution.lock.yml index 8fe267e9a11..ee6b6c3fc30 100644 --- a/.github/workflows/daily-model-resolution.lock.yml +++ b/.github/workflows/daily-model-resolution.lock.yml @@ -1604,6 +1604,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml index cdddb2c9c83..a2db2ae794d 100644 --- a/.github/workflows/daily-multi-device-docs-tester.lock.yml +++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml @@ -1629,6 +1629,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml index fe68e375cec..7f9ce2e00cb 100644 --- a/.github/workflows/daily-news.lock.yml +++ b/.github/workflows/daily-news.lock.yml @@ -1906,6 +1906,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml index 61275711b8e..bb1f349b76d 100644 --- a/.github/workflows/daily-observability-report.lock.yml +++ b/.github/workflows/daily-observability-report.lock.yml @@ -1644,6 +1644,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index 59b0662765b..23893e90afd 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -2377,6 +2377,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-pr-review-cursor.lock.yml b/.github/workflows/daily-pr-review-cursor.lock.yml index e6e560b0c5b..ef4c9cbf380 100644 --- a/.github/workflows/daily-pr-review-cursor.lock.yml +++ b/.github/workflows/daily-pr-review-cursor.lock.yml @@ -1590,6 +1590,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-regression-audit-kiro.lock.yml b/.github/workflows/daily-regression-audit-kiro.lock.yml index f5ff64e51a7..63af2c6d237 100644 --- a/.github/workflows/daily-regression-audit-kiro.lock.yml +++ b/.github/workflows/daily-regression-audit-kiro.lock.yml @@ -1579,6 +1579,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml index 9d2c50d422b..b59ff1514b2 100644 --- a/.github/workflows/daily-regulatory.lock.yml +++ b/.github/workflows/daily-regulatory.lock.yml @@ -2357,6 +2357,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-reliability-review.lock.yml b/.github/workflows/daily-reliability-review.lock.yml index 32f1abcf021..db4b12804fc 100644 --- a/.github/workflows/daily-reliability-review.lock.yml +++ b/.github/workflows/daily-reliability-review.lock.yml @@ -1622,6 +1622,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml index 7e81fae17cd..425cd9377a6 100644 --- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml +++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml @@ -1913,6 +1913,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml index efd8efb83e8..867369f8958 100644 --- a/.github/workflows/daily-repo-chronicle.lock.yml +++ b/.github/workflows/daily-repo-chronicle.lock.yml @@ -1696,6 +1696,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-report-dispatcher.lock.yml b/.github/workflows/daily-report-dispatcher.lock.yml index 634b75317d0..742bace64af 100644 --- a/.github/workflows/daily-report-dispatcher.lock.yml +++ b/.github/workflows/daily-report-dispatcher.lock.yml @@ -1630,6 +1630,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml index a70232233c5..0007f089889 100644 --- a/.github/workflows/daily-safe-output-integrator.lock.yml +++ b/.github/workflows/daily-safe-output-integrator.lock.yml @@ -1611,6 +1611,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml index f1a8782f706..74c07320dd2 100644 --- a/.github/workflows/daily-safe-output-optimizer.lock.yml +++ b/.github/workflows/daily-safe-output-optimizer.lock.yml @@ -1864,6 +1864,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml index 21179241d87..ac9ce7c4776 100644 --- a/.github/workflows/daily-safe-outputs-conformance.lock.yml +++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml @@ -1625,6 +1625,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml index 9a7c33f392c..0a301f0fa18 100644 --- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml +++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml @@ -1890,6 +1890,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-schema-audit-cursor.lock.yml b/.github/workflows/daily-schema-audit-cursor.lock.yml index f69f85c79a6..06ef5fc2934 100644 --- a/.github/workflows/daily-schema-audit-cursor.lock.yml +++ b/.github/workflows/daily-schema-audit-cursor.lock.yml @@ -1576,6 +1576,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml index fa72f70897f..88507d86a11 100644 --- a/.github/workflows/daily-secrets-analysis.lock.yml +++ b/.github/workflows/daily-secrets-analysis.lock.yml @@ -1664,6 +1664,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-security-observability.lock.yml b/.github/workflows/daily-security-observability.lock.yml index b08e2fd7d51..81cf3e4b81e 100644 --- a/.github/workflows/daily-security-observability.lock.yml +++ b/.github/workflows/daily-security-observability.lock.yml @@ -1776,6 +1776,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml index 96a491d84c9..28dfd327f05 100644 --- a/.github/workflows/daily-security-red-team.lock.yml +++ b/.github/workflows/daily-security-red-team.lock.yml @@ -1920,6 +1920,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml index 41e636d6550..e9a3092d1c5 100644 --- a/.github/workflows/daily-semgrep-scan.lock.yml +++ b/.github/workflows/daily-semgrep-scan.lock.yml @@ -1590,6 +1590,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-spdd-spec-planner.lock.yml b/.github/workflows/daily-spdd-spec-planner.lock.yml index d4cd5558035..57a1cce2f4f 100644 --- a/.github/workflows/daily-spdd-spec-planner.lock.yml +++ b/.github/workflows/daily-spdd-spec-planner.lock.yml @@ -1628,6 +1628,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-spec-coverage-kiro.lock.yml b/.github/workflows/daily-spec-coverage-kiro.lock.yml index 2809100303c..0e4455ab49b 100644 --- a/.github/workflows/daily-spec-coverage-kiro.lock.yml +++ b/.github/workflows/daily-spec-coverage-kiro.lock.yml @@ -1576,6 +1576,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-spending-forecast.lock.yml b/.github/workflows/daily-spending-forecast.lock.yml index 208709c7f49..38904def398 100644 --- a/.github/workflows/daily-spending-forecast.lock.yml +++ b/.github/workflows/daily-spending-forecast.lock.yml @@ -1747,6 +1747,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-squid-image-scan.lock.yml b/.github/workflows/daily-squid-image-scan.lock.yml index e82c6b3f5b3..0fec87059dd 100644 --- a/.github/workflows/daily-squid-image-scan.lock.yml +++ b/.github/workflows/daily-squid-image-scan.lock.yml @@ -1715,6 +1715,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-storify.lock.yml b/.github/workflows/daily-storify.lock.yml index 0a9c33fec5f..c16ef4df70b 100644 --- a/.github/workflows/daily-storify.lock.yml +++ b/.github/workflows/daily-storify.lock.yml @@ -1739,6 +1739,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml index c6524aecaf5..feb9e9ad6bf 100644 --- a/.github/workflows/daily-syntax-error-quality.lock.yml +++ b/.github/workflows/daily-syntax-error-quality.lock.yml @@ -1572,6 +1572,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml index 12d5fb2c14b..e9f1a3704d3 100644 --- a/.github/workflows/daily-team-evolution-insights.lock.yml +++ b/.github/workflows/daily-team-evolution-insights.lock.yml @@ -1704,6 +1704,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml index 553b8e9fa3d..082f8d1794e 100644 --- a/.github/workflows/daily-team-status.lock.yml +++ b/.github/workflows/daily-team-status.lock.yml @@ -1583,6 +1583,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml index f348185d178..cfc0645ca34 100644 --- a/.github/workflows/daily-testify-uber-super-expert.lock.yml +++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml @@ -1712,6 +1712,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-tlc-test-expert.lock.yml b/.github/workflows/daily-tlc-test-expert.lock.yml index 434a96d4af5..14138e2c641 100644 --- a/.github/workflows/daily-tlc-test-expert.lock.yml +++ b/.github/workflows/daily-tlc-test-expert.lock.yml @@ -1703,6 +1703,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-token-consumption-report.lock.yml b/.github/workflows/daily-token-consumption-report.lock.yml index dd186076079..e1588d5f9bc 100644 --- a/.github/workflows/daily-token-consumption-report.lock.yml +++ b/.github/workflows/daily-token-consumption-report.lock.yml @@ -1796,6 +1796,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml index 7b625072374..512ceeeb484 100644 --- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml +++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml @@ -1647,6 +1647,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-vulnhunter-scan.lock.yml b/.github/workflows/daily-vulnhunter-scan.lock.yml index 867a9444e12..2d93ed5b827 100644 --- a/.github/workflows/daily-vulnhunter-scan.lock.yml +++ b/.github/workflows/daily-vulnhunter-scan.lock.yml @@ -1601,6 +1601,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-windows-defender-scan.lock.yml b/.github/workflows/daily-windows-defender-scan.lock.yml index c6eef0f353d..f7ceab7f058 100644 --- a/.github/workflows/daily-windows-defender-scan.lock.yml +++ b/.github/workflows/daily-windows-defender-scan.lock.yml @@ -1608,6 +1608,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml index 2070a0c8af8..77684fd11da 100644 --- a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml +++ b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml @@ -1504,6 +1504,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/daily-work-queue-formal-verification.lock.yml b/.github/workflows/daily-work-queue-formal-verification.lock.yml index 7c4d14d3a7f..cf2059aedde 100644 --- a/.github/workflows/daily-work-queue-formal-verification.lock.yml +++ b/.github/workflows/daily-work-queue-formal-verification.lock.yml @@ -1554,6 +1554,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-work-queues-report.lock.yml b/.github/workflows/daily-work-queues-report.lock.yml index 457e1ec3ab4..2064b43e240 100644 --- a/.github/workflows/daily-work-queues-report.lock.yml +++ b/.github/workflows/daily-work-queues-report.lock.yml @@ -1590,6 +1590,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-workflow-security-model.lock.yml b/.github/workflows/daily-workflow-security-model.lock.yml index 462da98fc0d..070a3d891bb 100644 --- a/.github/workflows/daily-workflow-security-model.lock.yml +++ b/.github/workflows/daily-workflow-security-model.lock.yml @@ -1747,6 +1747,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml index f7cb1dbe3c0..931b3cbba57 100644 --- a/.github/workflows/daily-workflow-updater.lock.yml +++ b/.github/workflows/daily-workflow-updater.lock.yml @@ -1573,6 +1573,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml index 101a8be55e7..cae73dfcf3e 100644 --- a/.github/workflows/daily-yamllint-fixer.lock.yml +++ b/.github/workflows/daily-yamllint-fixer.lock.yml @@ -1633,6 +1633,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml index 196160cc8cd..1fbbbe1d62f 100644 --- a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml +++ b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml @@ -2000,6 +2000,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml index 8957a049835..974c94bc324 100644 --- a/.github/workflows/dead-code-remover.lock.yml +++ b/.github/workflows/dead-code-remover.lock.yml @@ -1706,6 +1706,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml index a4000f532cf..61e6059511e 100644 --- a/.github/workflows/deep-report.lock.yml +++ b/.github/workflows/deep-report.lock.yml @@ -2501,6 +2501,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/deepsec-security-scan.lock.yml b/.github/workflows/deepsec-security-scan.lock.yml index 7184ea971f5..4504e50afb9 100644 --- a/.github/workflows/deepsec-security-scan.lock.yml +++ b/.github/workflows/deepsec-security-scan.lock.yml @@ -1602,6 +1602,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml index b7dadfdb7d0..e719a308b18 100644 --- a/.github/workflows/delight.lock.yml +++ b/.github/workflows/delight.lock.yml @@ -1693,6 +1693,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml index 017105df843..6c15b8f5148 100644 --- a/.github/workflows/dependabot-burner.lock.yml +++ b/.github/workflows/dependabot-burner.lock.yml @@ -1791,6 +1791,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml index d9df8260383..85755dea3f4 100644 --- a/.github/workflows/dependabot-go-checker.lock.yml +++ b/.github/workflows/dependabot-go-checker.lock.yml @@ -1645,6 +1645,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml index 05655e57259..1c41daa15a3 100644 --- a/.github/workflows/deployment-incident-monitor.lock.yml +++ b/.github/workflows/deployment-incident-monitor.lock.yml @@ -1551,6 +1551,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/design-decision-gate.lock.yml b/.github/workflows/design-decision-gate.lock.yml index 4d9527f1abd..fc40c5bfae8 100644 --- a/.github/workflows/design-decision-gate.lock.yml +++ b/.github/workflows/design-decision-gate.lock.yml @@ -1662,6 +1662,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/designer-drift-audit.lock.yml b/.github/workflows/designer-drift-audit.lock.yml index 7a8e4b00dee..323129f824a 100644 --- a/.github/workflows/designer-drift-audit.lock.yml +++ b/.github/workflows/designer-drift-audit.lock.yml @@ -1507,6 +1507,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/detection-analysis-report.lock.yml b/.github/workflows/detection-analysis-report.lock.yml index a3fa88e19f0..fc03a72fda8 100644 --- a/.github/workflows/detection-analysis-report.lock.yml +++ b/.github/workflows/detection-analysis-report.lock.yml @@ -1786,6 +1786,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml index 48754158d60..9f21d0cac1b 100644 --- a/.github/workflows/dev-hawk.lock.yml +++ b/.github/workflows/dev-hawk.lock.yml @@ -1683,6 +1683,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml index e5a99c24c7e..80d42bbefec 100644 --- a/.github/workflows/dev.lock.yml +++ b/.github/workflows/dev.lock.yml @@ -1303,6 +1303,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml index d28623676df..abd5c8bad2e 100644 --- a/.github/workflows/developer-docs-consolidator.lock.yml +++ b/.github/workflows/developer-docs-consolidator.lock.yml @@ -1905,6 +1905,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml index 9547f6a4b47..05496257259 100644 --- a/.github/workflows/dictation-prompt.lock.yml +++ b/.github/workflows/dictation-prompt.lock.yml @@ -1574,6 +1574,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml index b1b589b45be..8d819b40b99 100644 --- a/.github/workflows/docs-noob-tester.lock.yml +++ b/.github/workflows/docs-noob-tester.lock.yml @@ -1632,6 +1632,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml index 22c1cb080a2..7c00441e9b0 100644 --- a/.github/workflows/draft-pr-cleanup.lock.yml +++ b/.github/workflows/draft-pr-cleanup.lock.yml @@ -1579,6 +1579,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml index a9f1940bd73..87ab31fc1bb 100644 --- a/.github/workflows/duplicate-code-detector.lock.yml +++ b/.github/workflows/duplicate-code-detector.lock.yml @@ -1621,6 +1621,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/engine-conformance-agy.lock.yml b/.github/workflows/engine-conformance-agy.lock.yml index 0087cb66fca..87eaad5e2e3 100644 --- a/.github/workflows/engine-conformance-agy.lock.yml +++ b/.github/workflows/engine-conformance-agy.lock.yml @@ -1716,6 +1716,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-aider.lock.yml b/.github/workflows/engine-conformance-aider.lock.yml index 1b020218f37..6f8aed70dd8 100644 --- a/.github/workflows/engine-conformance-aider.lock.yml +++ b/.github/workflows/engine-conformance-aider.lock.yml @@ -2240,6 +2240,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-atomic.lock.yml b/.github/workflows/engine-conformance-atomic.lock.yml index d07343af1be..47bca28fb32 100644 --- a/.github/workflows/engine-conformance-atomic.lock.yml +++ b/.github/workflows/engine-conformance-atomic.lock.yml @@ -1761,6 +1761,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-claude.lock.yml b/.github/workflows/engine-conformance-claude.lock.yml index 044f9e35c02..911dc26e114 100644 --- a/.github/workflows/engine-conformance-claude.lock.yml +++ b/.github/workflows/engine-conformance-claude.lock.yml @@ -1671,6 +1671,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-codex.lock.yml b/.github/workflows/engine-conformance-codex.lock.yml index ef6313b1edd..6151d13e088 100644 --- a/.github/workflows/engine-conformance-codex.lock.yml +++ b/.github/workflows/engine-conformance-codex.lock.yml @@ -1662,6 +1662,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-copilot.lock.yml b/.github/workflows/engine-conformance-copilot.lock.yml index 5917e9faeea..84c9960b7ab 100644 --- a/.github/workflows/engine-conformance-copilot.lock.yml +++ b/.github/workflows/engine-conformance-copilot.lock.yml @@ -1670,6 +1670,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/engine-conformance-crush.lock.yml b/.github/workflows/engine-conformance-crush.lock.yml index cac16711ad9..bfcc7317edf 100644 --- a/.github/workflows/engine-conformance-crush.lock.yml +++ b/.github/workflows/engine-conformance-crush.lock.yml @@ -1909,6 +1909,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-cursor.lock.yml b/.github/workflows/engine-conformance-cursor.lock.yml index 6ba26223a44..609aab10f42 100644 --- a/.github/workflows/engine-conformance-cursor.lock.yml +++ b/.github/workflows/engine-conformance-cursor.lock.yml @@ -1832,6 +1832,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-deepseek-harness.lock.yml b/.github/workflows/engine-conformance-deepseek-harness.lock.yml index 70b38c22e33..07bbfb006dc 100644 --- a/.github/workflows/engine-conformance-deepseek-harness.lock.yml +++ b/.github/workflows/engine-conformance-deepseek-harness.lock.yml @@ -1810,6 +1810,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-dispatcher.lock.yml b/.github/workflows/engine-conformance-dispatcher.lock.yml index 39233ff0741..4cb55e8f0fd 100644 --- a/.github/workflows/engine-conformance-dispatcher.lock.yml +++ b/.github/workflows/engine-conformance-dispatcher.lock.yml @@ -1623,6 +1623,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/engine-conformance-factory.lock.yml b/.github/workflows/engine-conformance-factory.lock.yml index 90311218728..6cbb77c0ada 100644 --- a/.github/workflows/engine-conformance-factory.lock.yml +++ b/.github/workflows/engine-conformance-factory.lock.yml @@ -1704,6 +1704,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-gemini.lock.yml b/.github/workflows/engine-conformance-gemini.lock.yml index cf72aee2db9..c2f02955749 100644 --- a/.github/workflows/engine-conformance-gemini.lock.yml +++ b/.github/workflows/engine-conformance-gemini.lock.yml @@ -1632,6 +1632,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-goose.lock.yml b/.github/workflows/engine-conformance-goose.lock.yml index 86e624550b0..92d116ec72c 100644 --- a/.github/workflows/engine-conformance-goose.lock.yml +++ b/.github/workflows/engine-conformance-goose.lock.yml @@ -1765,6 +1765,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-kiro.lock.yml b/.github/workflows/engine-conformance-kiro.lock.yml index 031e6e5cd19..949a2062944 100644 --- a/.github/workflows/engine-conformance-kiro.lock.yml +++ b/.github/workflows/engine-conformance-kiro.lock.yml @@ -1814,6 +1814,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-mini-swe-agent.lock.yml b/.github/workflows/engine-conformance-mini-swe-agent.lock.yml index 540be3845d2..d3106f7c1f2 100644 --- a/.github/workflows/engine-conformance-mini-swe-agent.lock.yml +++ b/.github/workflows/engine-conformance-mini-swe-agent.lock.yml @@ -1938,6 +1938,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-opencode.lock.yml b/.github/workflows/engine-conformance-opencode.lock.yml index 1d8a8bf5d19..6db09b97dd2 100644 --- a/.github/workflows/engine-conformance-opencode.lock.yml +++ b/.github/workflows/engine-conformance-opencode.lock.yml @@ -1864,6 +1864,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-pi.lock.yml b/.github/workflows/engine-conformance-pi.lock.yml index fd78bfcfea4..9cc1c580488 100644 --- a/.github/workflows/engine-conformance-pi.lock.yml +++ b/.github/workflows/engine-conformance-pi.lock.yml @@ -1650,6 +1650,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/engine-conformance-pydantic-ai.lock.yml b/.github/workflows/engine-conformance-pydantic-ai.lock.yml index e00bbe919bd..2771e896a86 100644 --- a/.github/workflows/engine-conformance-pydantic-ai.lock.yml +++ b/.github/workflows/engine-conformance-pydantic-ai.lock.yml @@ -2353,6 +2353,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/enterprise-docs-audit.lock.yml b/.github/workflows/enterprise-docs-audit.lock.yml index f57ef919cc7..c968907fd65 100644 --- a/.github/workflows/enterprise-docs-audit.lock.yml +++ b/.github/workflows/enterprise-docs-audit.lock.yml @@ -1533,6 +1533,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/eslint-factory-dispatcher.lock.yml b/.github/workflows/eslint-factory-dispatcher.lock.yml index a8ff7ae37b1..5842dd5c718 100644 --- a/.github/workflows/eslint-factory-dispatcher.lock.yml +++ b/.github/workflows/eslint-factory-dispatcher.lock.yml @@ -1627,6 +1627,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml index 16317b13fa0..ddb235ebe8d 100644 --- a/.github/workflows/eslint-miner.lock.yml +++ b/.github/workflows/eslint-miner.lock.yml @@ -1726,6 +1726,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/eslint-monster.lock.yml b/.github/workflows/eslint-monster.lock.yml index 4f8844ced9f..959e91855a3 100644 --- a/.github/workflows/eslint-monster.lock.yml +++ b/.github/workflows/eslint-monster.lock.yml @@ -1794,6 +1794,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/eslint-refiner.lock.yml b/.github/workflows/eslint-refiner.lock.yml index 8962e531595..430554e348f 100644 --- a/.github/workflows/eslint-refiner.lock.yml +++ b/.github/workflows/eslint-refiner.lock.yml @@ -1773,6 +1773,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml index 672c082256b..bfc4c9c3a7a 100644 --- a/.github/workflows/evoskill-evolver.lock.yml +++ b/.github/workflows/evoskill-evolver.lock.yml @@ -1667,6 +1667,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/example-failure-category-filter.lock.yml b/.github/workflows/example-failure-category-filter.lock.yml index ac2a87f86c6..835658a4156 100644 --- a/.github/workflows/example-failure-category-filter.lock.yml +++ b/.github/workflows/example-failure-category-filter.lock.yml @@ -1515,6 +1515,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml index 917a629e048..b25d09322f8 100644 --- a/.github/workflows/example-permissions-warning.lock.yml +++ b/.github/workflows/example-permissions-warning.lock.yml @@ -1414,6 +1414,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml index 916ffb0e9aa..5e7bcd68105 100644 --- a/.github/workflows/example-workflow-analyzer.lock.yml +++ b/.github/workflows/example-workflow-analyzer.lock.yml @@ -1653,6 +1653,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/feature-grower.lock.yml b/.github/workflows/feature-grower.lock.yml index 922e7092804..59869cffbf9 100644 --- a/.github/workflows/feature-grower.lock.yml +++ b/.github/workflows/feature-grower.lock.yml @@ -1600,6 +1600,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml index 6c422f3f7ca..11970232e95 100644 --- a/.github/workflows/firewall-escape.lock.yml +++ b/.github/workflows/firewall-escape.lock.yml @@ -1702,6 +1702,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml index 3b25c1a974c..06e4f191294 100644 --- a/.github/workflows/firewall.lock.yml +++ b/.github/workflows/firewall.lock.yml @@ -1456,6 +1456,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/front-page-copy-guard.lock.yml b/.github/workflows/front-page-copy-guard.lock.yml index 3b2b4411145..48ad9ee523b 100644 --- a/.github/workflows/front-page-copy-guard.lock.yml +++ b/.github/workflows/front-page-copy-guard.lock.yml @@ -1536,6 +1536,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml index c3b599525de..0a26fd9e0d9 100644 --- a/.github/workflows/functional-pragmatist.lock.yml +++ b/.github/workflows/functional-pragmatist.lock.yml @@ -1580,6 +1580,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml index 9dfde4f4255..20d00109316 100644 --- a/.github/workflows/github-mcp-structural-analysis.lock.yml +++ b/.github/workflows/github-mcp-structural-analysis.lock.yml @@ -2005,6 +2005,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml index f039a7fea5e..37533a33192 100644 --- a/.github/workflows/github-mcp-tools-report.lock.yml +++ b/.github/workflows/github-mcp-tools-report.lock.yml @@ -1743,6 +1743,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml index 0f56e3e740a..39086d096ac 100644 --- a/.github/workflows/github-remote-mcp-auth-test.lock.yml +++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml @@ -1514,6 +1514,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index 7a635e502aa..9e39cd5802e 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -1861,6 +1861,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml index ecd4c006efb..9ee12c70fa1 100644 --- a/.github/workflows/go-fan.lock.yml +++ b/.github/workflows/go-fan.lock.yml @@ -1813,6 +1813,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 23b061439dd..712a2006218 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -1747,6 +1747,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml index a500bf874d0..f7ecb1767df 100644 --- a/.github/workflows/go-pattern-detector.lock.yml +++ b/.github/workflows/go-pattern-detector.lock.yml @@ -1669,6 +1669,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml index aa1bb066f81..154051a96f5 100644 --- a/.github/workflows/gpclean.lock.yml +++ b/.github/workflows/gpclean.lock.yml @@ -1656,6 +1656,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml index c247fe06716..b43bf468c99 100644 --- a/.github/workflows/grumpy-reviewer.lock.yml +++ b/.github/workflows/grumpy-reviewer.lock.yml @@ -1686,6 +1686,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/hippo-embed.lock.yml b/.github/workflows/hippo-embed.lock.yml index 7498cb236fe..cae901b2b32 100644 --- a/.github/workflows/hippo-embed.lock.yml +++ b/.github/workflows/hippo-embed.lock.yml @@ -1563,6 +1563,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index c31580a1ac0..6fa5582698c 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -1731,6 +1731,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/impeccable-skills-reviewer.lock.yml b/.github/workflows/impeccable-skills-reviewer.lock.yml index e7af71df5cd..8a6f65f1086 100644 --- a/.github/workflows/impeccable-skills-reviewer.lock.yml +++ b/.github/workflows/impeccable-skills-reviewer.lock.yml @@ -1785,6 +1785,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml index 089e867a74c..9908d7d8e6e 100644 --- a/.github/workflows/instructions-janitor.lock.yml +++ b/.github/workflows/instructions-janitor.lock.yml @@ -1738,6 +1738,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml index a03e814669e..71be3f0c947 100644 --- a/.github/workflows/issue-arborist.lock.yml +++ b/.github/workflows/issue-arborist.lock.yml @@ -1703,6 +1703,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml index 5631a57af51..2c20018b33c 100644 --- a/.github/workflows/issue-monster.lock.yml +++ b/.github/workflows/issue-monster.lock.yml @@ -2080,6 +2080,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml index eef88ffb44b..bb69b14e297 100644 --- a/.github/workflows/issue-triage-agent.lock.yml +++ b/.github/workflows/issue-triage-agent.lock.yml @@ -1757,6 +1757,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml index c84349dcf0b..e0303b8692d 100644 --- a/.github/workflows/jsweep.lock.yml +++ b/.github/workflows/jsweep.lock.yml @@ -1658,6 +1658,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml index ac58aaf8796..86165bc5a1b 100644 --- a/.github/workflows/layout-spec-maintainer.lock.yml +++ b/.github/workflows/layout-spec-maintainer.lock.yml @@ -1635,6 +1635,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/lint-monster.lock.yml b/.github/workflows/lint-monster.lock.yml index d44156a5f4f..8fa013f9a85 100644 --- a/.github/workflows/lint-monster.lock.yml +++ b/.github/workflows/lint-monster.lock.yml @@ -1699,6 +1699,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml index 7f33efda9fd..bc1a7108169 100644 --- a/.github/workflows/linter-miner.lock.yml +++ b/.github/workflows/linter-miner.lock.yml @@ -1751,6 +1751,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml index 37694c0aa3a..aeafdc0fc7e 100644 --- a/.github/workflows/lockfile-stats.lock.yml +++ b/.github/workflows/lockfile-stats.lock.yml @@ -1649,6 +1649,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/mattpocock-skills-reviewer.lock.yml b/.github/workflows/mattpocock-skills-reviewer.lock.yml index 417fdcfba64..da1d6f17697 100644 --- a/.github/workflows/mattpocock-skills-reviewer.lock.yml +++ b/.github/workflows/mattpocock-skills-reviewer.lock.yml @@ -1891,6 +1891,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml index 29c9369cddc..8b454e8715c 100644 --- a/.github/workflows/mcp-inspector.lock.yml +++ b/.github/workflows/mcp-inspector.lock.yml @@ -2009,6 +2009,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml index 850ac34ce10..93f27e607b0 100644 --- a/.github/workflows/mergefest.lock.yml +++ b/.github/workflows/mergefest.lock.yml @@ -1617,6 +1617,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml index 17a8c09e236..a89a9d16b45 100644 --- a/.github/workflows/metrics-collector.lock.yml +++ b/.github/workflows/metrics-collector.lock.yml @@ -1722,6 +1722,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/necromancer.lock.yml b/.github/workflows/necromancer.lock.yml index 781184d406a..ae97609e15b 100644 --- a/.github/workflows/necromancer.lock.yml +++ b/.github/workflows/necromancer.lock.yml @@ -1608,6 +1608,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml index 61f3e770bf0..5cf8c8dfd3b 100644 --- a/.github/workflows/notion-issue-summary.lock.yml +++ b/.github/workflows/notion-issue-summary.lock.yml @@ -1425,6 +1425,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/objective-impact-report.lock.yml b/.github/workflows/objective-impact-report.lock.yml index 046c410170c..d9c808c48dc 100644 --- a/.github/workflows/objective-impact-report.lock.yml +++ b/.github/workflows/objective-impact-report.lock.yml @@ -1638,6 +1638,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml index 95736fdb5ab..30037a226f1 100644 --- a/.github/workflows/org-health-report.lock.yml +++ b/.github/workflows/org-health-report.lock.yml @@ -1695,6 +1695,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml index 1c424328d4d..ca430d588b1 100644 --- a/.github/workflows/pdf-summary.lock.yml +++ b/.github/workflows/pdf-summary.lock.yml @@ -1717,6 +1717,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml index 14d915a8322..3347d0162f6 100644 --- a/.github/workflows/plan.lock.yml +++ b/.github/workflows/plan.lock.yml @@ -1747,6 +1747,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml index 17e6c5f6c25..23efe818136 100644 --- a/.github/workflows/poem-bot.lock.yml +++ b/.github/workflows/poem-bot.lock.yml @@ -2024,6 +2024,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/ponytail-reviewer.lock.yml b/.github/workflows/ponytail-reviewer.lock.yml index 4604f19ec78..63db25bd415 100644 --- a/.github/workflows/ponytail-reviewer.lock.yml +++ b/.github/workflows/ponytail-reviewer.lock.yml @@ -1756,6 +1756,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml index e189a6a9276..25e4be9f805 100644 --- a/.github/workflows/portfolio-analyst.lock.yml +++ b/.github/workflows/portfolio-analyst.lock.yml @@ -1816,6 +1816,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/pr-code-quality-reviewer.lock.yml b/.github/workflows/pr-code-quality-reviewer.lock.yml index 77c3a0dff9b..549b538fe2b 100644 --- a/.github/workflows/pr-code-quality-reviewer.lock.yml +++ b/.github/workflows/pr-code-quality-reviewer.lock.yml @@ -1807,6 +1807,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pr-description-caveman.lock.yml b/.github/workflows/pr-description-caveman.lock.yml index 50435dfa8c4..f3cc9fd0002 100644 --- a/.github/workflows/pr-description-caveman.lock.yml +++ b/.github/workflows/pr-description-caveman.lock.yml @@ -1591,6 +1591,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pr-finisher.lock.yml b/.github/workflows/pr-finisher.lock.yml index de9544111a2..4f8618979e8 100644 --- a/.github/workflows/pr-finisher.lock.yml +++ b/.github/workflows/pr-finisher.lock.yml @@ -1642,6 +1642,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml index 4e64b424d3e..68e059fca04 100644 --- a/.github/workflows/pr-nitpick-reviewer.lock.yml +++ b/.github/workflows/pr-nitpick-reviewer.lock.yml @@ -1755,6 +1755,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pr-sous-chef.lock.yml b/.github/workflows/pr-sous-chef.lock.yml index 0d91371f4f5..3681cc687f8 100644 --- a/.github/workflows/pr-sous-chef.lock.yml +++ b/.github/workflows/pr-sous-chef.lock.yml @@ -3974,6 +3974,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/pr-specification-reviewer.lock.yml b/.github/workflows/pr-specification-reviewer.lock.yml index 112a0f09080..9870b7d147c 100644 --- a/.github/workflows/pr-specification-reviewer.lock.yml +++ b/.github/workflows/pr-specification-reviewer.lock.yml @@ -1725,6 +1725,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml index 1288b66e96b..46c5e7b5ad4 100644 --- a/.github/workflows/pr-triage-agent.lock.yml +++ b/.github/workflows/pr-triage-agent.lock.yml @@ -2114,6 +2114,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml index fa913a6c6d3..98812961489 100644 --- a/.github/workflows/prompt-clustering-analysis.lock.yml +++ b/.github/workflows/prompt-clustering-analysis.lock.yml @@ -1831,6 +1831,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml index 210acd82f6d..ea2d85cbfcd 100644 --- a/.github/workflows/purelock.lock.yml +++ b/.github/workflows/purelock.lock.yml @@ -1817,6 +1817,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml index 7d7e82dece4..afa237919ff 100644 --- a/.github/workflows/python-data-charts.lock.yml +++ b/.github/workflows/python-data-charts.lock.yml @@ -1740,6 +1740,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index 81d66838f30..24b50a9f82a 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -1816,6 +1816,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/refactoring-cadence.lock.yml b/.github/workflows/refactoring-cadence.lock.yml index e4569e62343..687489fef72 100644 --- a/.github/workflows/refactoring-cadence.lock.yml +++ b/.github/workflows/refactoring-cadence.lock.yml @@ -1587,6 +1587,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index aaf076b30ca..b7ff3f7b826 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -1835,6 +1835,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml index 6dad215185c..c6cea8372f8 100644 --- a/.github/workflows/release.lock.yml +++ b/.github/workflows/release.lock.yml @@ -1761,6 +1761,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml index f212d2dfe09..14d6a9839e3 100644 --- a/.github/workflows/repo-audit-analyzer.lock.yml +++ b/.github/workflows/repo-audit-analyzer.lock.yml @@ -1608,6 +1608,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml index ec296a64b8a..b8f7fe3a42d 100644 --- a/.github/workflows/repo-tree-map.lock.yml +++ b/.github/workflows/repo-tree-map.lock.yml @@ -1584,6 +1584,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml index 480d6bd04fd..6b8ffdd0ccc 100644 --- a/.github/workflows/repository-quality-improver.lock.yml +++ b/.github/workflows/repository-quality-improver.lock.yml @@ -1615,6 +1615,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml index 6832e181f65..8bc21190e46 100644 --- a/.github/workflows/research.lock.yml +++ b/.github/workflows/research.lock.yml @@ -1600,6 +1600,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml index c3d9c2ab799..5da24de4790 100644 --- a/.github/workflows/safe-output-health.lock.yml +++ b/.github/workflows/safe-output-health.lock.yml @@ -1759,6 +1759,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml index 1854441868e..c03c42c0484 100644 --- a/.github/workflows/schema-consistency-checker.lock.yml +++ b/.github/workflows/schema-consistency-checker.lock.yml @@ -1606,6 +1606,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/schema-feature-coverage.lock.yml b/.github/workflows/schema-feature-coverage.lock.yml index 8193be5fe87..2c180b35f8c 100644 --- a/.github/workflows/schema-feature-coverage.lock.yml +++ b/.github/workflows/schema-feature-coverage.lock.yml @@ -1562,6 +1562,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml index 1da46c4bb2a..4705b4f2968 100644 --- a/.github/workflows/scout.lock.yml +++ b/.github/workflows/scout.lock.yml @@ -1849,6 +1849,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml index b55f15fcd55..918c9982c86 100644 --- a/.github/workflows/security-compliance.lock.yml +++ b/.github/workflows/security-compliance.lock.yml @@ -1648,6 +1648,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml index 486a365e15b..3b9610baa0c 100644 --- a/.github/workflows/security-review.lock.yml +++ b/.github/workflows/security-review.lock.yml @@ -1970,6 +1970,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml index a3181cc50ef..5e1512c8896 100644 --- a/.github/workflows/semantic-function-refactor.lock.yml +++ b/.github/workflows/semantic-function-refactor.lock.yml @@ -1648,6 +1648,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml index e51bc5f6d58..e4676d69ccc 100644 --- a/.github/workflows/sergo.lock.yml +++ b/.github/workflows/sergo.lock.yml @@ -1823,6 +1823,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/sighthound-security-scan.lock.yml b/.github/workflows/sighthound-security-scan.lock.yml index 6090fada500..6dd13ff853f 100644 --- a/.github/workflows/sighthound-security-scan.lock.yml +++ b/.github/workflows/sighthound-security-scan.lock.yml @@ -1675,6 +1675,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/skillet.lock.yml b/.github/workflows/skillet.lock.yml index 0572fbfff4b..71d76b6005b 100644 --- a/.github/workflows/skillet.lock.yml +++ b/.github/workflows/skillet.lock.yml @@ -1680,6 +1680,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index adb8ab64fcb..8e53c5c2871 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -1799,6 +1799,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml index d4ad34c0517..0bd1e235422 100644 --- a/.github/workflows/smoke-agent-all-merged.lock.yml +++ b/.github/workflows/smoke-agent-all-merged.lock.yml @@ -1675,6 +1675,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml index 376bef2d4b0..4166ff2e7ac 100644 --- a/.github/workflows/smoke-agent-all-none.lock.yml +++ b/.github/workflows/smoke-agent-all-none.lock.yml @@ -1669,6 +1669,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml index a7cccb7f821..1bb6e9af827 100644 --- a/.github/workflows/smoke-agent-public-approved.lock.yml +++ b/.github/workflows/smoke-agent-public-approved.lock.yml @@ -1725,6 +1725,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml index 33794ef6fc1..07b672dd977 100644 --- a/.github/workflows/smoke-agent-public-none.lock.yml +++ b/.github/workflows/smoke-agent-public-none.lock.yml @@ -1669,6 +1669,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml index 2e11b98a39c..8818944abb8 100644 --- a/.github/workflows/smoke-agent-scoped-approved.lock.yml +++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml @@ -1737,6 +1737,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-agy.lock.yml b/.github/workflows/smoke-agy.lock.yml index 139e30265ef..b135937a252 100644 --- a/.github/workflows/smoke-agy.lock.yml +++ b/.github/workflows/smoke-agy.lock.yml @@ -1679,6 +1679,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-aider.lock.yml b/.github/workflows/smoke-aider.lock.yml index 211c4a47bab..6906eed7ec9 100644 --- a/.github/workflows/smoke-aider.lock.yml +++ b/.github/workflows/smoke-aider.lock.yml @@ -2084,6 +2084,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-atomic.lock.yml b/.github/workflows/smoke-atomic.lock.yml index 22ff22e6ae2..4b564d5f933 100644 --- a/.github/workflows/smoke-atomic.lock.yml +++ b/.github/workflows/smoke-atomic.lock.yml @@ -1639,6 +1639,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-azure-codex.lock.yml b/.github/workflows/smoke-azure-codex.lock.yml index f843fe34fe5..72cf256edd3 100644 --- a/.github/workflows/smoke-azure-codex.lock.yml +++ b/.github/workflows/smoke-azure-codex.lock.yml @@ -1317,6 +1317,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-azure-pi.lock.yml b/.github/workflows/smoke-azure-pi.lock.yml index 9433d4f63ae..2d17ec99af0 100644 --- a/.github/workflows/smoke-azure-pi.lock.yml +++ b/.github/workflows/smoke-azure-pi.lock.yml @@ -1319,6 +1319,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-builtin-ledgers.lock.yml b/.github/workflows/smoke-builtin-ledgers.lock.yml index 7028082d0dc..a3d1735829b 100644 --- a/.github/workflows/smoke-builtin-ledgers.lock.yml +++ b/.github/workflows/smoke-builtin-ledgers.lock.yml @@ -1816,6 +1816,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml index 4961bfd3abd..eb7e51722b0 100644 --- a/.github/workflows/smoke-call-workflow.lock.yml +++ b/.github/workflows/smoke-call-workflow.lock.yml @@ -1634,6 +1634,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml index d35146129a4..a0952d5c342 100644 --- a/.github/workflows/smoke-checkout-pr-dispatch.lock.yml +++ b/.github/workflows/smoke-checkout-pr-dispatch.lock.yml @@ -1655,6 +1655,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-ci.lock.yml b/.github/workflows/smoke-ci.lock.yml index 7199d2ad29c..572b1a39d9b 100644 --- a/.github/workflows/smoke-ci.lock.yml +++ b/.github/workflows/smoke-ci.lock.yml @@ -1840,6 +1840,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-claude-auto.lock.yml b/.github/workflows/smoke-claude-auto.lock.yml index 50e6898835d..eca0c1e61e5 100644 --- a/.github/workflows/smoke-claude-auto.lock.yml +++ b/.github/workflows/smoke-claude-auto.lock.yml @@ -1321,6 +1321,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-claude-copilot-auto.lock.yml b/.github/workflows/smoke-claude-copilot-auto.lock.yml index 5e7bc38208f..40ffb182d6f 100644 --- a/.github/workflows/smoke-claude-copilot-auto.lock.yml +++ b/.github/workflows/smoke-claude-copilot-auto.lock.yml @@ -1320,6 +1320,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-claude-copilot.lock.yml b/.github/workflows/smoke-claude-copilot.lock.yml index 7a13ffb554a..7f1f2df8fe1 100644 --- a/.github/workflows/smoke-claude-copilot.lock.yml +++ b/.github/workflows/smoke-claude-copilot.lock.yml @@ -1409,6 +1409,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-claude-dynamic.lock.yml b/.github/workflows/smoke-claude-dynamic.lock.yml index 1ad4917f933..d433285d198 100644 --- a/.github/workflows/smoke-claude-dynamic.lock.yml +++ b/.github/workflows/smoke-claude-dynamic.lock.yml @@ -1390,6 +1390,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-claude-on-copilot.lock.yml b/.github/workflows/smoke-claude-on-copilot.lock.yml index c00de7f191a..a81573172b4 100644 --- a/.github/workflows/smoke-claude-on-copilot.lock.yml +++ b/.github/workflows/smoke-claude-on-copilot.lock.yml @@ -1622,6 +1622,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-claude-routed-anthropic.lock.yml b/.github/workflows/smoke-claude-routed-anthropic.lock.yml index ae93c917f6f..221936f44a1 100644 --- a/.github/workflows/smoke-claude-routed-anthropic.lock.yml +++ b/.github/workflows/smoke-claude-routed-anthropic.lock.yml @@ -1674,6 +1674,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-claude-routed.lock.yml b/.github/workflows/smoke-claude-routed.lock.yml index 244785b9b5b..cc408f7775f 100644 --- a/.github/workflows/smoke-claude-routed.lock.yml +++ b/.github/workflows/smoke-claude-routed.lock.yml @@ -1669,6 +1669,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-claude-sub-agents.lock.yml b/.github/workflows/smoke-claude-sub-agents.lock.yml index 5f1e1a1787f..32ebc96ff46 100644 --- a/.github/workflows/smoke-claude-sub-agents.lock.yml +++ b/.github/workflows/smoke-claude-sub-agents.lock.yml @@ -1521,6 +1521,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index d2e068fd4b7..a3235f73310 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -2720,6 +2720,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-codex-auto.lock.yml b/.github/workflows/smoke-codex-auto.lock.yml index 89ba4f672e6..402b5d1c177 100644 --- a/.github/workflows/smoke-codex-auto.lock.yml +++ b/.github/workflows/smoke-codex-auto.lock.yml @@ -1308,6 +1308,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-codex-bare-auto.lock.yml b/.github/workflows/smoke-codex-bare-auto.lock.yml index 282c9b4e0b6..aec5eae7001 100644 --- a/.github/workflows/smoke-codex-bare-auto.lock.yml +++ b/.github/workflows/smoke-codex-bare-auto.lock.yml @@ -1309,6 +1309,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-codex-routed-openai.lock.yml b/.github/workflows/smoke-codex-routed-openai.lock.yml index 1ded11275b9..2905fa06564 100644 --- a/.github/workflows/smoke-codex-routed-openai.lock.yml +++ b/.github/workflows/smoke-codex-routed-openai.lock.yml @@ -1445,6 +1445,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-codex-routed.lock.yml b/.github/workflows/smoke-codex-routed.lock.yml index 8a645ce2f6f..bbe171dbdd4 100644 --- a/.github/workflows/smoke-codex-routed.lock.yml +++ b/.github/workflows/smoke-codex-routed.lock.yml @@ -1436,6 +1436,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 1f3e88db0a7..537b1c72ca3 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -2146,6 +2146,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml index 51519596d54..fbde12feb45 100644 --- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml @@ -3177,6 +3177,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml index b1d0069e153..22c9d581935 100644 --- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml +++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml @@ -3200,6 +3200,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml index 5507bf4efcd..c912355c8ae 100644 --- a/.github/workflows/smoke-copilot-arm.lock.yml +++ b/.github/workflows/smoke-copilot-arm.lock.yml @@ -2939,6 +2939,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-auto.lock.yml b/.github/workflows/smoke-copilot-auto.lock.yml index 6b89ad005aa..00ab8b36160 100644 --- a/.github/workflows/smoke-copilot-auto.lock.yml +++ b/.github/workflows/smoke-copilot-auto.lock.yml @@ -1585,6 +1585,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml b/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml index 4a868575566..6a74284991b 100644 --- a/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml +++ b/.github/workflows/smoke-copilot-dynamic-workflow.lock.yml @@ -1599,6 +1599,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: ${{ needs.activation.outputs.artifact_prefix }}info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-mai.lock.yml b/.github/workflows/smoke-copilot-mai.lock.yml index b59054423ab..ea62ba9ae8e 100644 --- a/.github/workflows/smoke-copilot-mai.lock.yml +++ b/.github/workflows/smoke-copilot-mai.lock.yml @@ -1670,6 +1670,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-routed-claude.lock.yml b/.github/workflows/smoke-copilot-routed-claude.lock.yml index ddad294e607..6cacf3d4742 100644 --- a/.github/workflows/smoke-copilot-routed-claude.lock.yml +++ b/.github/workflows/smoke-copilot-routed-claude.lock.yml @@ -1652,6 +1652,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-routed-steering.lock.yml b/.github/workflows/smoke-copilot-routed-steering.lock.yml index 54b1bb19400..f77cb29524e 100644 --- a/.github/workflows/smoke-copilot-routed-steering.lock.yml +++ b/.github/workflows/smoke-copilot-routed-steering.lock.yml @@ -1651,6 +1651,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-routed.lock.yml b/.github/workflows/smoke-copilot-routed.lock.yml index a4f5dc61273..4c7839caa25 100644 --- a/.github/workflows/smoke-copilot-routed.lock.yml +++ b/.github/workflows/smoke-copilot-routed.lock.yml @@ -1636,6 +1636,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml b/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml index a3f58cf1d4d..01cb82d6e9e 100644 --- a/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml +++ b/.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml @@ -1645,6 +1645,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-sdk-routed.lock.yml b/.github/workflows/smoke-copilot-sdk-routed.lock.yml index edc78b4c610..a6b9a26192b 100644 --- a/.github/workflows/smoke-copilot-sdk-routed.lock.yml +++ b/.github/workflows/smoke-copilot-sdk-routed.lock.yml @@ -1629,6 +1629,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-sdk.lock.yml b/.github/workflows/smoke-copilot-sdk.lock.yml index 83d03423306..8ac45ad0878 100644 --- a/.github/workflows/smoke-copilot-sdk.lock.yml +++ b/.github/workflows/smoke-copilot-sdk.lock.yml @@ -1662,6 +1662,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-small.lock.yml b/.github/workflows/smoke-copilot-small.lock.yml index aadadaf1b3e..7f76f8b674d 100644 --- a/.github/workflows/smoke-copilot-small.lock.yml +++ b/.github/workflows/smoke-copilot-small.lock.yml @@ -1690,6 +1690,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot-sub-agents.lock.yml b/.github/workflows/smoke-copilot-sub-agents.lock.yml index 26b9e999812..b7655f8853d 100644 --- a/.github/workflows/smoke-copilot-sub-agents.lock.yml +++ b/.github/workflows/smoke-copilot-sub-agents.lock.yml @@ -1616,6 +1616,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index a98bf45c1c8..82c35d7dbb6 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -3205,6 +3205,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml index 0b084e4bab4..d046322d803 100644 --- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml @@ -1769,6 +1769,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-crush.lock.yml b/.github/workflows/smoke-crush.lock.yml index 058090c2228..0ef075068ed 100644 --- a/.github/workflows/smoke-crush.lock.yml +++ b/.github/workflows/smoke-crush.lock.yml @@ -1981,6 +1981,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-cursor.lock.yml b/.github/workflows/smoke-cursor.lock.yml index caebf622d86..df284d71191 100644 --- a/.github/workflows/smoke-cursor.lock.yml +++ b/.github/workflows/smoke-cursor.lock.yml @@ -1942,6 +1942,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-deepseek-harness.lock.yml b/.github/workflows/smoke-deepseek-harness.lock.yml index 214be83ac5b..43279eebcfe 100644 --- a/.github/workflows/smoke-deepseek-harness.lock.yml +++ b/.github/workflows/smoke-deepseek-harness.lock.yml @@ -1838,6 +1838,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-drive.lock.yml b/.github/workflows/smoke-drive.lock.yml index c3e3d930b8c..3206f85bc4a 100644 --- a/.github/workflows/smoke-drive.lock.yml +++ b/.github/workflows/smoke-drive.lock.yml @@ -1769,6 +1769,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-factory.lock.yml b/.github/workflows/smoke-factory.lock.yml index d2b712630d2..88d132b4aee 100644 --- a/.github/workflows/smoke-factory.lock.yml +++ b/.github/workflows/smoke-factory.lock.yml @@ -1582,6 +1582,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml index 7c939fb3b81..0b8b3e6141e 100644 --- a/.github/workflows/smoke-gemini.lock.yml +++ b/.github/workflows/smoke-gemini.lock.yml @@ -1888,6 +1888,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-github-claude.lock.yml b/.github/workflows/smoke-github-claude.lock.yml index be43a08ed96..bf055d38a50 100644 --- a/.github/workflows/smoke-github-claude.lock.yml +++ b/.github/workflows/smoke-github-claude.lock.yml @@ -1621,6 +1621,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-github-codex.lock.yml b/.github/workflows/smoke-github-codex.lock.yml index 567e68689e7..1149e2fe904 100644 --- a/.github/workflows/smoke-github-codex.lock.yml +++ b/.github/workflows/smoke-github-codex.lock.yml @@ -1303,6 +1303,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-goose.lock.yml b/.github/workflows/smoke-goose.lock.yml index fbe79fa3621..36adf3d87d5 100644 --- a/.github/workflows/smoke-goose.lock.yml +++ b/.github/workflows/smoke-goose.lock.yml @@ -2084,6 +2084,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-issues.lock.yml b/.github/workflows/smoke-issues.lock.yml index 4439b910f20..e27ae5bdeaf 100644 --- a/.github/workflows/smoke-issues.lock.yml +++ b/.github/workflows/smoke-issues.lock.yml @@ -1654,6 +1654,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-kiro.lock.yml b/.github/workflows/smoke-kiro.lock.yml index 0bc7c0e6fbd..95d1ad7179e 100644 --- a/.github/workflows/smoke-kiro.lock.yml +++ b/.github/workflows/smoke-kiro.lock.yml @@ -1924,6 +1924,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-mini-swe-agent.lock.yml b/.github/workflows/smoke-mini-swe-agent.lock.yml index 391511d4a45..df9dbba9d56 100644 --- a/.github/workflows/smoke-mini-swe-agent.lock.yml +++ b/.github/workflows/smoke-mini-swe-agent.lock.yml @@ -1663,6 +1663,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml index 09ac2ac87ee..4d2f8ec3eec 100644 --- a/.github/workflows/smoke-multi-pr.lock.yml +++ b/.github/workflows/smoke-multi-pr.lock.yml @@ -1714,6 +1714,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml index 3830c027fc5..d33022375da 100644 --- a/.github/workflows/smoke-opencode.lock.yml +++ b/.github/workflows/smoke-opencode.lock.yml @@ -2015,6 +2015,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml index a430ce2af66..f68a99e3822 100644 --- a/.github/workflows/smoke-otel-backends.lock.yml +++ b/.github/workflows/smoke-otel-backends.lock.yml @@ -1756,6 +1756,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-pi-auto.lock.yml b/.github/workflows/smoke-pi-auto.lock.yml index 54243460e78..776548742c7 100644 --- a/.github/workflows/smoke-pi-auto.lock.yml +++ b/.github/workflows/smoke-pi-auto.lock.yml @@ -1308,6 +1308,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/.github/workflows/smoke-pi-routed-claude.lock.yml b/.github/workflows/smoke-pi-routed-claude.lock.yml index 1d268769cb4..7d8e3a34b90 100644 --- a/.github/workflows/smoke-pi-routed-claude.lock.yml +++ b/.github/workflows/smoke-pi-routed-claude.lock.yml @@ -1607,6 +1607,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-pi-routed.lock.yml b/.github/workflows/smoke-pi-routed.lock.yml index ad06aac31cf..123c2edbf5f 100644 --- a/.github/workflows/smoke-pi-routed.lock.yml +++ b/.github/workflows/smoke-pi-routed.lock.yml @@ -1617,6 +1617,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-pi-sub-agents.lock.yml b/.github/workflows/smoke-pi-sub-agents.lock.yml index 1c516864bf2..7d06d8903f4 100644 --- a/.github/workflows/smoke-pi-sub-agents.lock.yml +++ b/.github/workflows/smoke-pi-sub-agents.lock.yml @@ -1506,6 +1506,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-pi.lock.yml b/.github/workflows/smoke-pi.lock.yml index 994cfa12e4e..673876276aa 100644 --- a/.github/workflows/smoke-pi.lock.yml +++ b/.github/workflows/smoke-pi.lock.yml @@ -1723,6 +1723,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index 83db4f7c3c5..c184aca8f91 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -2042,6 +2042,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-pydantic.lock.yml b/.github/workflows/smoke-pydantic.lock.yml index 89f56c84e10..e4f071f09ef 100644 --- a/.github/workflows/smoke-pydantic.lock.yml +++ b/.github/workflows/smoke-pydantic.lock.yml @@ -2367,6 +2367,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-repo-memory-ledger.lock.yml b/.github/workflows/smoke-repo-memory-ledger.lock.yml index 785603ce220..b49d0d8dbc1 100644 --- a/.github/workflows/smoke-repo-memory-ledger.lock.yml +++ b/.github/workflows/smoke-repo-memory-ledger.lock.yml @@ -1657,6 +1657,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-security-alerts.lock.yml b/.github/workflows/smoke-security-alerts.lock.yml index faca70c719c..9b6e72452bc 100644 --- a/.github/workflows/smoke-security-alerts.lock.yml +++ b/.github/workflows/smoke-security-alerts.lock.yml @@ -1481,6 +1481,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-service-ports.lock.yml b/.github/workflows/smoke-service-ports.lock.yml index 540d43f10b4..b11a4df5a76 100644 --- a/.github/workflows/smoke-service-ports.lock.yml +++ b/.github/workflows/smoke-service-ports.lock.yml @@ -1678,6 +1678,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml index e37678508dd..b8c17d8ed45 100644 --- a/.github/workflows/smoke-temporary-id.lock.yml +++ b/.github/workflows/smoke-temporary-id.lock.yml @@ -1790,6 +1790,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml index e1141d9ef80..0277af99fad 100644 --- a/.github/workflows/smoke-test-tools.lock.yml +++ b/.github/workflows/smoke-test-tools.lock.yml @@ -1746,6 +1746,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml index dc6bdd170ac..a19b53bd734 100644 --- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml +++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml @@ -1825,6 +1825,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-work-queue-dispatcher.lock.yml b/.github/workflows/smoke-work-queue-dispatcher.lock.yml index 104d66cb403..c513070b7fb 100644 --- a/.github/workflows/smoke-work-queue-dispatcher.lock.yml +++ b/.github/workflows/smoke-work-queue-dispatcher.lock.yml @@ -1618,6 +1618,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-work-queue-worker.lock.yml b/.github/workflows/smoke-work-queue-worker.lock.yml index 7c9414783f2..1682a86bcfb 100644 --- a/.github/workflows/smoke-work-queue-worker.lock.yml +++ b/.github/workflows/smoke-work-queue-worker.lock.yml @@ -1607,6 +1607,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-work-queue.lock.yml b/.github/workflows/smoke-work-queue.lock.yml index 31744f5af14..a33d2af5164 100644 --- a/.github/workflows/smoke-work-queue.lock.yml +++ b/.github/workflows/smoke-work-queue.lock.yml @@ -1599,6 +1599,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index 541bd5d780e..7f9ed97bb72 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -1642,6 +1642,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: ${{ needs.activation.outputs.artifact_prefix }}info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index 572bce73974..dd7e497b1c1 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -1693,6 +1693,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: ${{ needs.activation.outputs.artifact_prefix }}info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml index ee11387306b..5b576029ef1 100644 --- a/.github/workflows/spec-enforcer.lock.yml +++ b/.github/workflows/spec-enforcer.lock.yml @@ -1695,6 +1695,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml index 503eff26595..dbc4409978b 100644 --- a/.github/workflows/spec-extractor.lock.yml +++ b/.github/workflows/spec-extractor.lock.yml @@ -1743,6 +1743,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/spec-librarian.lock.yml b/.github/workflows/spec-librarian.lock.yml index 1b22b01eeae..68e9fc0885c 100644 --- a/.github/workflows/spec-librarian.lock.yml +++ b/.github/workflows/spec-librarian.lock.yml @@ -1655,6 +1655,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/squad-game-planner.lock.yml b/.github/workflows/squad-game-planner.lock.yml index 96ecec85816..c48ec0c887f 100644 --- a/.github/workflows/squad-game-planner.lock.yml +++ b/.github/workflows/squad-game-planner.lock.yml @@ -1583,6 +1583,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/squad-implement-worker.lock.yml b/.github/workflows/squad-implement-worker.lock.yml index 9b23e255ebc..7e3b4a0c172 100644 --- a/.github/workflows/squad-implement-worker.lock.yml +++ b/.github/workflows/squad-implement-worker.lock.yml @@ -1741,6 +1741,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/squad-plan.lock.yml b/.github/workflows/squad-plan.lock.yml index 7deada596f4..8f806f59797 100644 --- a/.github/workflows/squad-plan.lock.yml +++ b/.github/workflows/squad-plan.lock.yml @@ -1648,6 +1648,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/squad.lock.yml b/.github/workflows/squad.lock.yml index 9d00db284d5..d37086d717a 100644 --- a/.github/workflows/squad.lock.yml +++ b/.github/workflows/squad.lock.yml @@ -2280,6 +2280,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/stale-pr-cleanup.lock.yml b/.github/workflows/stale-pr-cleanup.lock.yml index 4088895cd28..355e2cacc39 100644 --- a/.github/workflows/stale-pr-cleanup.lock.yml +++ b/.github/workflows/stale-pr-cleanup.lock.yml @@ -1604,6 +1604,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml index 29f0befd5f9..edc3d0fb08d 100644 --- a/.github/workflows/stale-repo-identifier.lock.yml +++ b/.github/workflows/stale-repo-identifier.lock.yml @@ -1836,6 +1836,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml index 49386f28c45..a427ba48526 100644 --- a/.github/workflows/static-analysis-report.lock.yml +++ b/.github/workflows/static-analysis-report.lock.yml @@ -1857,6 +1857,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml index 81d2c38b5bc..974f6988e59 100644 --- a/.github/workflows/step-name-alignment.lock.yml +++ b/.github/workflows/step-name-alignment.lock.yml @@ -1665,6 +1665,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml index b894205946a..50f1444618d 100644 --- a/.github/workflows/sub-issue-closer.lock.yml +++ b/.github/workflows/sub-issue-closer.lock.yml @@ -1547,6 +1547,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml index 971065a4306..7c4dcded86e 100644 --- a/.github/workflows/super-linter.lock.yml +++ b/.github/workflows/super-linter.lock.yml @@ -1597,6 +1597,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 1c2a368c157..831fc8771c1 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -1838,6 +1838,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml index fd851ee1478..5604fd03864 100644 --- a/.github/workflows/terminal-stylist.lock.yml +++ b/.github/workflows/terminal-stylist.lock.yml @@ -1556,6 +1556,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/test-quality-sentinel.lock.yml b/.github/workflows/test-quality-sentinel.lock.yml index 8a8b816d5f5..189cfb018fd 100644 --- a/.github/workflows/test-quality-sentinel.lock.yml +++ b/.github/workflows/test-quality-sentinel.lock.yml @@ -1683,6 +1683,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index a52d1bec596..7f305a7d338 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -1740,6 +1740,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml index b094a1e3bc7..20b86055037 100644 --- a/.github/workflows/typist.lock.yml +++ b/.github/workflows/typist.lock.yml @@ -1723,6 +1723,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml index f3fd099d84c..8362f9ddf96 100644 --- a/.github/workflows/ubuntu-image-analyzer.lock.yml +++ b/.github/workflows/ubuntu-image-analyzer.lock.yml @@ -1623,6 +1623,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/uk-ai-operational-resilience.lock.yml b/.github/workflows/uk-ai-operational-resilience.lock.yml index 53c01dea13d..2fd78ff7e7a 100644 --- a/.github/workflows/uk-ai-operational-resilience.lock.yml +++ b/.github/workflows/uk-ai-operational-resilience.lock.yml @@ -1602,6 +1602,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index fa4bbe39935..10fb2f8e76f 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -1744,6 +1744,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml index 39bc0b48e77..beb9a242006 100644 --- a/.github/workflows/update-astro.lock.yml +++ b/.github/workflows/update-astro.lock.yml @@ -1663,6 +1663,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml index 4a01a874398..0125291e0c2 100644 --- a/.github/workflows/video-analyzer.lock.yml +++ b/.github/workflows/video-analyzer.lock.yml @@ -1528,6 +1528,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml index 0bebeb0ae18..f57a5a9730f 100644 --- a/.github/workflows/visual-regression-checker.lock.yml +++ b/.github/workflows/visual-regression-checker.lock.yml @@ -1635,6 +1635,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml index ffeeda3d4e3..201d013b057 100644 --- a/.github/workflows/weekly-blog-post-writer.lock.yml +++ b/.github/workflows/weekly-blog-post-writer.lock.yml @@ -1855,6 +1855,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index 5c2a3a254bc..5486f8f3fb3 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -1685,6 +1685,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-git-simulator-dreaming.lock.yml b/.github/workflows/weekly-git-simulator-dreaming.lock.yml index f3da8c1ae7e..19b90db1d91 100644 --- a/.github/workflows/weekly-git-simulator-dreaming.lock.yml +++ b/.github/workflows/weekly-git-simulator-dreaming.lock.yml @@ -1911,6 +1911,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml index c1b0677ac38..cbf854782ff 100644 --- a/.github/workflows/weekly-issue-summary.lock.yml +++ b/.github/workflows/weekly-issue-summary.lock.yml @@ -1604,6 +1604,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/weekly-network-domains-audit.lock.yml b/.github/workflows/weekly-network-domains-audit.lock.yml index bff9772456b..c72a081a048 100644 --- a/.github/workflows/weekly-network-domains-audit.lock.yml +++ b/.github/workflows/weekly-network-domains-audit.lock.yml @@ -1561,6 +1561,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-otel-reference.lock.yml b/.github/workflows/weekly-otel-reference.lock.yml index 87aa2915e38..39fd5c962b5 100644 --- a/.github/workflows/weekly-otel-reference.lock.yml +++ b/.github/workflows/weekly-otel-reference.lock.yml @@ -1549,6 +1549,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml index 0864c1177a2..a3a23091a6c 100644 --- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml +++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml @@ -1553,6 +1553,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/windows-grower.lock.yml b/.github/workflows/windows-grower.lock.yml index b3a58420e22..9f4c552c869 100644 --- a/.github/workflows/windows-grower.lock.yml +++ b/.github/workflows/windows-grower.lock.yml @@ -1602,6 +1602,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/windows.lock.yml b/.github/workflows/windows.lock.yml index 930566aaf3f..b24fb0e0971 100644 --- a/.github/workflows/windows.lock.yml +++ b/.github/workflows/windows.lock.yml @@ -1667,6 +1667,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: ${{ needs.activation.outputs.artifact_prefix }}info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml index b384903151f..7a2913be31f 100644 --- a/.github/workflows/workflow-generator.lock.yml +++ b/.github/workflows/workflow-generator.lock.yml @@ -1643,6 +1643,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml index 8f4ac1d8343..ca798174931 100644 --- a/.github/workflows/workflow-health-manager.lock.yml +++ b/.github/workflows/workflow-health-manager.lock.yml @@ -1740,6 +1740,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml index 36bccb6fbe3..70899ab232e 100644 --- a/.github/workflows/workflow-normalizer.lock.yml +++ b/.github/workflows/workflow-normalizer.lock.yml @@ -1665,6 +1665,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Warn if threat detection produced no verdict if: always() && needs.detection.result != 'skipped' && (needs.detection.outputs.detection_reason == 'agent_failure' || needs.detection.outputs.detection_reason == 'parse_error' || needs.detection.outputs.detection_conclusion == '') run: echo "::warning::Threat detection produced no security verdict. Review the detection job logs before trusting the agent outputs." diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml index 1d24fbb13d0..f2c6d9e6a0c 100644 --- a/.github/workflows/workflow-skill-extractor.lock.yml +++ b/.github/workflows/workflow-skill-extractor.lock.yml @@ -1617,6 +1617,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/actions/setup/js/unified_session.test.cjs b/actions/setup/js/unified_session.test.cjs index 960ba1bcf4a..78d02039f42 100644 --- a/actions/setup/js/unified_session.test.cjs +++ b/actions/setup/js/unified_session.test.cjs @@ -1386,6 +1386,43 @@ describe("Unified conclusion session", () => { expect(events.find(event => event.type === "workflow.info").data).not.toHaveProperty("secret"); }); + it("publishes downloaded Kiro activation metadata without expanding session.init", () => { + // Synthetic transport regression, not native Kiro structured-stream evidence. + write("aw_info.json", { + engine_id: "kiro", + agent_version: "2.31.1", + model: "kiro/auto", + event_name: "schedule", + sha: "a".repeat(40), + run_id: 123, + run_attempt: 2, + workflow_id: "example/repo/.github/workflows/smoke-kiro.lock.yml@refs/heads/main", + }); + write("agent-session.jsonl", [{ type: "session.init", data: { sourceEngine: "kiro", agentVersion: "2.31.1" } }]); + + const events = writeUnifiedSession({ rootDir: root }); + const metadata = events.filter(event => event.type === "workflow.info"); + expect(metadata).toHaveLength(1); + expect(metadata[0]).toMatchObject({ + data: { + engineId: "kiro", + agentVersion: "2.31.1", + model: "kiro/auto", + requestedModel: "kiro/auto", + triggerType: "schedule", + sha: "a".repeat(40), + runId: 123, + runAttempt: 2, + workflowId: "example/repo/.github/workflows/smoke-kiro.lock.yml@refs/heads/main", + }, + provenance: { component: "workflow", phase: "activation", path: "aw_info.json", index: 0 }, + }); + expect(events.find(event => event.type === "session.init").data).toEqual({ sourceEngine: "kiro" }); + const persisted = fs.readFileSync(path.join(root, "usage/aw_session.jsonl"), "utf8"); + expect(persisted.trim().split("\n").map(JSON.parse)).toEqual(events); + expect(validateSession(persisted)).toBe(events.length); + }); + it("prefers runner routing metadata over agent metadata and preserves the harness outcome", () => { write("aw_info.json", { engine_id: "claude", diff --git a/docs/src/content/docs/specs/unified-agent-session-specification.md b/docs/src/content/docs/specs/unified-agent-session-specification.md index ace27be517a..44adfeeba0c 100644 --- a/docs/src/content/docs/specs/unified-agent-session-specification.md +++ b/docs/src/content/docs/specs/unified-agent-session-specification.md @@ -85,7 +85,11 @@ The agent artifact already contains native session evidence: Copilot session `logEntries` as `agent-session.jsonl` so conclusion can reuse canonical events without parsing the same native transcript again. After downloading agent, detection, safe-output, experiment, and eval evidence, the conclusion job merges these observations into -`usage/aw_session.jsonl`. The agent artifact also carries the split activation +`usage/aw_session.jsonl`. Conclusion also downloads activation's `info` artifact +to collect runner-owned `aw_info.json` as `workflow.info`, including available +engine, model, version, revision, and trigger metadata. Runtime model metadata, +when captured, takes precedence over the activation snapshot. +The agent artifact also carries the split activation `aw-prompts/system.txt` and `aw-prompts/user.txt` files; the merger records each available file as an untimed `prompt.system` or `prompt.user` event with its exact content and source path. These prompt events are omitted from default summaries. diff --git a/pkg/workflow/notify_comment_conclusion_helpers.go b/pkg/workflow/notify_comment_conclusion_helpers.go index 2ffb86de07e..15c95853be0 100644 --- a/pkg/workflow/notify_comment_conclusion_helpers.go +++ b/pkg/workflow/notify_comment_conclusion_helpers.go @@ -65,6 +65,7 @@ func (c *Compiler) buildConclusionSetupSteps(data *WorkflowData) []string { // Add artifact download steps once (shared by noop and conclusion steps). // In workflow_call context, use the per-invocation prefix to avoid artifact name clashes. steps = append(steps, buildAgentOutputDownloadSteps(artifactPrefixExprForDownstreamJob(data), c.getActionPin)...) + steps = append(steps, buildWorkflowInfoDownloadSteps(artifactPrefixExprForDownstreamJob(data), c.getActionPin)...) if isModelRoutingEnabled(data) || data.EngineConfig != nil && data.EngineConfig.ID == string(constants.CopilotEngine) { steps = append(steps, " - name: Restore runtime model metadata\n", diff --git a/pkg/workflow/safe_outputs_steps.go b/pkg/workflow/safe_outputs_steps.go index dc6efaecd2f..b9de1c68259 100644 --- a/pkg/workflow/safe_outputs_steps.go +++ b/pkg/workflow/safe_outputs_steps.go @@ -244,6 +244,15 @@ func buildAgentOutputDownloadSteps(prefix string, pinAction func(string) string) }, pinAction) } +func buildWorkflowInfoDownloadSteps(prefix string, pinAction func(string) string) []string { + return buildArtifactDownloadSteps(ArtifactDownloadConfig{ + ArtifactName: prefix + constants.InfoArtifactName.String(), + DownloadPath: constants.TmpGhAwDirSlash, + StepName: "Download workflow metadata", + IfCondition: "always()", + }, pinAction) +} + // buildDetectionArtifactDownloadSteps creates a step to download the detection artifact // into the threat-detection working directory so its firewall proxy/audit logs are // available for collect_usage_artifact_files.sh in the conclusion job (see gh-aw#54047). diff --git a/pkg/workflow/unified_session_artifact_test.go b/pkg/workflow/unified_session_artifact_test.go index 8a70aa93ae7..261b95c5837 100644 --- a/pkg/workflow/unified_session_artifact_test.go +++ b/pkg/workflow/unified_session_artifact_test.go @@ -63,6 +63,7 @@ func TestRuntimeModelMetadataConclusionTransport(t *testing.T) { require.GreaterOrEqual(t, download, 0) assert.Contains(t, steps[download:strings.Index(steps, "Restore runtime model metadata")], "path: /tmp/gh-aw/") assert.Less(t, download, strings.Index(steps, "Restore runtime model metadata")) + assert.Less(t, strings.Index(steps, "Download workflow metadata"), strings.Index(steps, "Restore runtime model metadata")) } else { assert.NotContains(t, paths, "/tmp/gh-aw/runtime/aw_info.json") assert.NotContains(t, steps, "Restore runtime model metadata") @@ -71,3 +72,41 @@ func TestRuntimeModelMetadataConclusionTransport(t *testing.T) { } } } + +func TestWorkflowMetadataConclusionTransport(t *testing.T) { + for _, id := range []string{"copilot", "claude", "codex", "gemini", "pi", "kiro"} { + for _, reusable := range []bool{false, true} { + t.Run(id+"/"+strconv.FormatBool(reusable), func(t *testing.T) { + for _, ghes := range []bool{false, true} { + t.Run("ghes/"+strconv.FormatBool(ghes), func(t *testing.T) { + compiler := NewCompiler() + compiler.SetGHESCompat(ghes) + compiler.configureGHESCompatibility() + data := &WorkflowData{ + AI: id, EngineConfig: &EngineConfig{ID: id}, + SafeOutputs: &SafeOutputsConfig{}, + On: "workflow_dispatch:", + } + if reusable { + data.On = "workflow_call:" + } + artifactName := "info" + if reusable { + artifactName = "${{ needs.activation.outputs.artifact_prefix }}info" + } + steps := strings.Join(compiler.buildConclusionSetupSteps(data), "") + download := extractWorkflowStepByName(t, steps, "Download workflow metadata") + assert.Contains(t, download, "if: always()") + assert.Contains(t, download, "continue-on-error: true") + assert.Contains(t, download, "name: "+artifactName+"\n") + assert.Contains(t, download, "path: /tmp/gh-aw/") + assert.NotContains(t, download, "pattern:") + assert.NotContains(t, download, "activation\n") + assert.Contains(t, download, "uses: "+compiler.getActionPin("actions/download-artifact")) + assert.Less(t, strings.Index(steps, "Download agent output artifact"), strings.Index(steps, "Download workflow metadata")) + }) + } + }) + } + } +} From 839476e2a8b83c481b5c64db34c9a3e761b2c1b7 Mon Sep 17 00:00:00 2001 From: pelikhan Date: Sun, 8 Nov 2026 20:02:54 -0800 Subject: [PATCH 2/2] fix: reconcile conclusion rerun identity and refresh metadata goldens Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../patch-conclusion-workflow-metadata.md | 2 +- actions/setup/js/unified_session.cjs | 35 ++++++-- actions/setup/js/unified_session.test.cjs | 85 ++++++++++++++++++- .../unified-agent-session-specification.md | 9 +- .../TestWasmGolden_AllEngines/claude.golden | 7 ++ .../TestWasmGolden_AllEngines/codex.golden | 7 ++ .../TestWasmGolden_AllEngines/copilot.golden | 7 ++ .../TestWasmGolden_AllEngines/gemini.golden | 7 ++ .../TestWasmGolden_AllEngines/pi.golden | 7 ++ .../basic-copilot.golden | 7 ++ .../custom-safe-output-max-length.golden | 7 ++ .../playwright-cli-mode.golden | 7 ++ .../smoke-copilot.golden | 7 ++ .../with-imports.golden | 7 ++ 14 files changed, 190 insertions(+), 11 deletions(-) diff --git a/.changeset/patch-conclusion-workflow-metadata.md b/.changeset/patch-conclusion-workflow-metadata.md index 394e7b392c4..b1084b1926d 100644 --- a/.changeset/patch-conclusion-workflow-metadata.md +++ b/.changeset/patch-conclusion-workflow-metadata.md @@ -2,4 +2,4 @@ "gh-aw": patch --- -Download activation's workflow metadata in conclusion so unified sessions retain available engine, model, version, revision, and trigger information. +Download activation's workflow metadata in conclusion so unified sessions retain available engine, model, version, revision, and trigger information. Reconcile current run identity when successful activation artifacts are reused by a later attempt, while preserving recorded identity for offline replay. diff --git a/actions/setup/js/unified_session.cjs b/actions/setup/js/unified_session.cjs index fef9ac5c966..85574a95551 100644 --- a/actions/setup/js/unified_session.cjs +++ b/actions/setup/js/unified_session.cjs @@ -18,6 +18,7 @@ const { estimateBaseline, projectModelConfig } = require("./routing_analytics.cj const { normalizeHarnessRetryRecord } = require("./harness_retry_record.cjs"); const { parseHarnessAttempts, correlateHarnessAttempts } = require("./harness_retry_session.cjs"); const { isDurableSessionRecord } = require("./durable_session_record.cjs"); +const { buildWorkflowCallId } = require("./aw_context.cjs"); const SESSION_FILE_FORMAT_VERSION = 1; @@ -163,7 +164,7 @@ function parseEngineSession(content, engine) { /** * Collect only known runtime directories; never follow artifact symlinks. * Replicated firewall files use logs > audit > legacy precedence, including empty files. - * @param {{rootDir?: string, engine?: string, protectedSessionCapture?: boolean, warn?: (message: string) => void, dailyAIC?: NodeJS.ProcessEnv, admission?: NodeJS.ProcessEnv, jobResults?: string, safeJobNames?: string, safeJobResults?: string, jobDurations?: Record}} [options] + * @param {{rootDir?: string, engine?: string, protectedSessionCapture?: boolean, warn?: (message: string) => void, dailyAIC?: NodeJS.ProcessEnv, executionIdentity?: {runId?: string, runAttempt: number}, admission?: NodeJS.ProcessEnv, jobResults?: string, safeJobNames?: string, safeJobResults?: string, jobDurations?: Record}} [options] * @returns {{events: import("./types/unified_session").UnifiedSession, maskedValues: string[]}} */ function collectUnifiedSession({ @@ -172,14 +173,16 @@ function collectUnifiedSession({ protectedSessionCapture = false, warn = message => console.warn(message), dailyAIC = process.env, + executionIdentity, admission = process.env, jobResults = process.env.GH_AW_JOB_RESULTS, safeJobNames = process.env.GH_AW_SAFE_JOB_NAMES, safeJobResults = process.env.GH_AW_SAFE_JOB_RESULTS, jobDurations = {}, } = {}) { - let currentRunId = dailyAIC.GITHUB_RUN_ID; - let currentRunAttempt = dailyAIC.GITHUB_RUN_ATTEMPT; + const liveIdentity = executionIdentity?.runId && Number.isSafeInteger(executionIdentity.runAttempt) && executionIdentity.runAttempt > 0 ? executionIdentity : undefined; + let currentRunId = liveIdentity?.runId ?? dailyAIC.GITHUB_RUN_ID; + let currentRunAttempt = liveIdentity ? String(liveIdentity.runAttempt) : dailyAIC.GITHUB_RUN_ATTEMPT; /** @type {SessionSource[]} */ const sources = []; const masks = new Set(); @@ -349,10 +352,25 @@ function collectUnifiedSession({ if (metadata) { const phase = metadata === path.join(rootDir, "runtime/aw_info.json") ? "agent" : metadata === path.join(rootDir, "usage/aw_info.json") ? "conclusion" : "activation"; add(metadata, "workflow", phase, "workflow.info"); - const info = sources.at(-1)?.events[0]?.data; + const event = sources.at(-1)?.events[0]; + const info = event?.data; const observedEngine = info?.engine_id; if (engine === undefined && typeof observedEngine === "string") engine = observedEngine; - if (info?.run_id !== undefined && info.run_id !== null && String(info.run_id) !== "") { + if (liveIdentity && event) { + // Successful activation artifacts can be reused by a later run attempt. + // Reconcile only at the explicit live boundary, without editing the snapshot. + const workflowId = info?.workflowId ?? info?.workflow_id; + const workflowCallId = buildWorkflowCallId(liveIdentity.runId, liveIdentity.runAttempt, typeof workflowId === "string" ? workflowId : undefined); + event.data = { + ...info, + run_id: liveIdentity.runId, + run_attempt: liveIdentity.runAttempt, + runId: liveIdentity.runId, + runAttempt: liveIdentity.runAttempt, + workflow_call_id: workflowCallId, + workflowCallId, + }; + } else if (info?.run_id !== undefined && info.run_id !== null && String(info.run_id) !== "") { currentRunId = String(info.run_id); currentRunAttempt = info.run_attempt !== undefined && info.run_attempt !== null ? String(info.run_attempt) : undefined; } @@ -916,7 +934,7 @@ function collectUnifiedSession({ } /** - * @param {{rootDir?: string, engine?: string, outputPath?: string, warn?: (message: string) => void, admission?: NodeJS.ProcessEnv, jobDurations?: Record, graders?: any[], customGraderIds?: string[]}} [options] + * @param {{rootDir?: string, engine?: string, outputPath?: string, warn?: (message: string) => void, executionIdentity?: {runId?: string, runAttempt: number}, admission?: NodeJS.ProcessEnv, jobDurations?: Record, graders?: any[], customGraderIds?: string[]}} [options] * @returns {import("./types/unified_session").UnifiedSession} */ function writeUnifiedSession(options = {}) { @@ -944,12 +962,13 @@ function writeUnifiedSession(options = {}) { } } -/** @param {{rootDir?: string, engine?: string, outputPath?: string, jobDurations?: Record, graders?: any[], customGraderIds?: string[]}} [options] @returns {Promise} */ +/** @param {{rootDir?: string, engine?: string, outputPath?: string, executionIdentity?: {runId?: string, runAttempt: number}, jobDurations?: Record, graders?: any[], customGraderIds?: string[]}} [options] @returns {Promise} */ async function main(options = {}) { const jobDurations = options.jobDurations ?? (await require("./workflow_job_durations.cjs").collectJobDurations({ warn: message => global.core.warning(message) })); const { readGraderManifestEnvironment, publishGraderSummary } = require("./grader_artifacts.cjs"); const manifest = options.graders === undefined ? readGraderManifestEnvironment() : { graders: options.graders }; - const events = writeUnifiedSession({ ...options, jobDurations, graders: manifest.graders, customGraderIds: options.customGraderIds ?? manifest.customGraders }); + const executionIdentity = options.executionIdentity ?? { runId: process.env.GITHUB_RUN_ID, runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT) }; + const events = writeUnifiedSession({ ...options, executionIdentity, jobDurations, graders: manifest.graders, customGraderIds: options.customGraderIds ?? manifest.customGraders }); const { publishUnifiedSessionSummary } = require("./unified_session_render.cjs"); await publishUnifiedSessionSummary(options.outputPath ?? path.join(options.rootDir ?? "/tmp/gh-aw", "usage/aw_session.jsonl")); await publishGraderSummary(events); diff --git a/actions/setup/js/unified_session.test.cjs b/actions/setup/js/unified_session.test.cjs index 78d02039f42..37258a0a4fb 100644 --- a/actions/setup/js/unified_session.test.cjs +++ b/actions/setup/js/unified_session.test.cjs @@ -1,7 +1,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import fs from "node:fs"; import path from "node:path"; -import { collectUnifiedSession, mergeSessionSources, normalizeRuntimeEvent, parseEngineSession, sessionTimestamp, writeUnifiedSession } from "./unified_session.cjs"; +import { collectUnifiedSession, main, mergeSessionSources, normalizeRuntimeEvent, parseEngineSession, sessionTimestamp, writeUnifiedSession } from "./unified_session.cjs"; import { serializeSessionArtifact, writeSessionArtifact } from "./session_artifact.cjs"; import { normalizeUnifiedSessionEvent } from "./unified_session_payload.cjs"; import { validateSession } from "./scripts/validate_session.cjs"; @@ -864,6 +864,89 @@ describe("Unified conclusion session", () => { expect(events.filter(event => event.type === "grader.result")).toHaveLength(1); }); + it.each(["aw_info.json", "activation/aw_info.json", "runtime/aw_info.json"])("reconciles reused successful activation from %s at the live conclusion boundary, not offline replay", async metadataPath => { + const workflowId = "org/repo/.github/workflows/worker.lock.yml@refs/heads/main"; + const callerWorkflowRef = "org/parent/.github/workflows/caller.yml@refs/heads/main"; + const snapshot = { + run_id: "123", + run_attempt: 1, + workflow_id: workflowId, + workflow_call_id: `123-1:${workflowId}`, + caller_workflow_ref: callerWorkflowRef, + engine_id: "codex", + model: "fixture-model", + context: { + episode_id: "100-1:root", + hop_id: "122-1:caller", + parent_hop_id: "100-1:root", + root_run_id: "100", + repo: "org/parent", + run_id: "122", + run_attempt: "1", + workflow_id: callerWorkflowRef, + workflow_call_id: `122-1:${callerWorkflowRef}`, + }, + }; + const metadataFile = write(metadataPath, snapshot); + const durable = ["1", "2"].flatMap(runAttempt => { + const identity = { engine: "codex", storage: "artifact", runId: "123", runAttempt, parentRunId: "122" }; + return [ + { type: "durable.restore", data: { ...identity, status: "restored", artifactId: runAttempt } }, + { type: "durable.session", data: { ...identity, status: "resumed", sessionId: `session-${runAttempt}` } }, + ]; + }); + const durableFile = write("agent/durable-session.jsonl", durable); + write( + "evals.jsonl", + ["1", "2"].map(runAttempt => ({ id: `attempt-${runAttempt}`, runid: "123", runAttempt, answer: "YES" })) + ); + write( + "agent/graders/grader_results.json", + [1, 2].map(attempt => ({ run: { id: "123", attempt }, results: [{ id: `attempt-${attempt}` }] })) + ); + const recorded = collectUnifiedSession({ rootDir: root, dailyAIC: { GITHUB_RUN_ID: "456", GITHUB_RUN_ATTEMPT: "3" } }).events; + expect(recorded.filter(event => event.type.startsWith("durable.")).map(event => event.data.runAttempt)).toEqual(["1", "1"]); + const recordedInfo = recorded.find(event => event.type === "workflow.info").data; + expect(recordedInfo).toMatchObject({ runId: "123", runAttempt: 1, workflowId, workflowCallId: `123-1:${workflowId}` }); + expect(recorded.find(event => event.type === "grader.result").data.run).toMatchObject({ id: "123", attempt: 1 }); + + global.core.summary = { addDetails: vi.fn(), write: vi.fn().mockResolvedValue(undefined) }; + process.env.GITHUB_STEP_SUMMARY = path.join(root, "step-summary.md"); + await main({ rootDir: root, jobDurations: {} }); + + const content = fs.readFileSync(path.join(root, "usage/aw_session.jsonl"), "utf8"); + const events = content.trim().split("\n").map(JSON.parse); + expect(validateSession(content)).toBe(events.length); + expect(events.find(event => event.type === "workflow.info")).toMatchObject({ + data: { + runId: "123", + runAttempt: 2, + workflowId, + workflowCallId: `123-2:${workflowId}`, + callerWorkflowRef, + engineId: "codex", + model: "fixture-model", + awContext: recordedInfo.awContext, + episode: recordedInfo.episode, + }, + provenance: { component: "workflow", phase: metadataPath.startsWith("runtime/") ? "agent" : "activation", path: metadataPath }, + }); + expect(events.filter(event => event.type.startsWith("durable."))).toMatchObject([ + { type: "durable.restore", data: { runId: "123", runAttempt: "2", parentRunId: "122", artifactId: "2" } }, + { type: "durable.session", data: { runId: "123", runAttempt: "2", parentRunId: "122", sessionId: "session-2" } }, + ]); + expect(events.filter(event => event.type.startsWith("durable."))).toHaveLength(2); + expect(events.filter(event => event.type === "eval.result").map(event => event.data.id)).toEqual(["attempt-2"]); + expect(events.find(event => event.type === "grader.result").data.run).toMatchObject({ id: "123", attempt: 2, graderCount: 10 }); + const graderOutput = JSON.parse(fs.readFileSync(path.join(root, "usage/graders/grader_results.json"), "utf8")); + expect(graderOutput.run).toMatchObject({ id: "123", attempt: 2 }); + expect(fs.readFileSync(metadataFile, "utf8")).toBe(JSON.stringify(snapshot)); + expect(fs.readFileSync(durableFile, "utf8")).toBe(durable.map(record => JSON.stringify(record)).join("\n") + "\n"); + const replay = collectUnifiedSession({ rootDir: root, dailyAIC: {} }).events; + expect(replay.filter(event => event.type.startsWith("durable.")).map(event => event.data.runAttempt)).toEqual(["1", "1"]); + expect(replay.find(event => event.type === "workflow.info").data).toEqual(recordedInfo); + }); + it("warns and omits results when the current run cannot be identified", () => { delete process.env.GITHUB_RUN_ID; delete process.env.GITHUB_RUN_ATTEMPT; diff --git a/docs/src/content/docs/specs/unified-agent-session-specification.md b/docs/src/content/docs/specs/unified-agent-session-specification.md index 39139b2c46e..101d87e974c 100644 --- a/docs/src/content/docs/specs/unified-agent-session-specification.md +++ b/docs/src/content/docs/specs/unified-agent-session-specification.md @@ -461,7 +461,14 @@ Grader and eval result collection MUST import only records attributed to the current run, not restored historical results. Runner-owned `aw_info.json` supplies the run ID and available attempt; the supplied collector environment (defaulting to the process environment) supplies them only when recorded run -identity is absent. An explicit environment snapshot MUST NOT borrow run identity +identity is absent. The live conclusion entry point explicitly supplies the +current execution identity, which MUST reconcile the in-memory workflow metadata +and derived workflow call ID before filtering durable, grader, and eval records +or computing built-in graders. Caller context and episode parent identities +remain unchanged. +This prevents a reused successful activation snapshot from selecting an earlier +attempt. Source artifacts remain unchanged; offline reconstruction retains +recorded-identity precedence. An explicit environment snapshot MUST NOT borrow run identity from the ambient process. Records from other runs or explicitly different attempts are excluded without changing source artifacts. Unattributed results or an unavailable current run ID produce collection diff --git a/pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden b/pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden index 0368d6592c1..98eed6ce7b7 100644 --- a/pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden +++ b/pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden @@ -1406,6 +1406,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden b/pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden index a36fd9ed5bc..fa6327a177d 100644 --- a/pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden +++ b/pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden @@ -1351,6 +1351,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden b/pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden index c0497099c38..6ad30808a70 100644 --- a/pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden +++ b/pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden @@ -1373,6 +1373,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden b/pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden index 5d4fecef4d0..223503e42fa 100644 --- a/pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden +++ b/pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden @@ -1323,6 +1323,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden b/pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden index 1541199f4fd..109946bcdfd 100644 --- a/pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden +++ b/pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden @@ -1327,6 +1327,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Download Safe Outputs Items Manifest id: download-safe-outputs-manifest if: always() diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden index 50ac05966e7..8b3fd7b97e9 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden @@ -1308,6 +1308,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/custom-safe-output-max-length.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/custom-safe-output-max-length.golden index daf912872be..404cbda34a9 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/custom-safe-output-max-length.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/custom-safe-output-max-length.golden @@ -1393,6 +1393,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden index c6fdd1411ce..2e483c0939f 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden @@ -1356,6 +1356,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden index 6a76bc63e7b..c244e8968e0 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden @@ -2589,6 +2589,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: | diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden index 9a2e85be111..0f66ea8504e 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden @@ -1310,6 +1310,13 @@ jobs: if [ -f "/tmp/gh-aw/agent_output.json" ]; then echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT" fi + - name: Download workflow metadata + if: always() + continue-on-error: true + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: info + path: /tmp/gh-aw/ - name: Restore runtime model metadata if: always() run: |