Compiler: auto-grant pull-requests:read to pre_activation for decentralized label_command on pull_request events by Copilot · Pull Request #44282 · github/gh-aw

Copilot · 2026-07-08T12:05:41Z

When label_command uses strategy: decentralized with pull_request events, the compiled pre_activation job inherited the workflow-level permissions: {} (empty), causing check_membership.cjs to receive HTTP 403 on GET /repos/{owner}/{repo}/pulls/{number} — the call it makes to verify PR provenance. This silently skipped all downstream jobs.

Changes

pkg/workflow/compiler_pre_activation_job.go — In buildPreActivationPermissions, auto-set pull-requests: read when LabelCommandDecentralized is true and the effective label command events include pull_request (covers both explicit events: [pull_request] and the default all-events case).
pkg/workflow/label_command_test.go — Added TestLabelCommandDecentralizedPreActivationPullRequestsReadPermission asserting the generated pre_activation job contains pull-requests: read for the affected configuration.
5 workflow lock files recompiled — ci-doctor, approach-validator, cloclo, dev, necromancer (all use decentralized label_command with pull_request events).

Before / After

# Before — pre_activation job had no permissions block
pre_activation:
  runs-on: ubuntu-slim
  # (no permissions:)

# After
pre_activation:
  runs-on: ubuntu-slim
  permissions:
    pull-requests: read

The existing workaround (on.permissions: { pull-requests: read } in frontmatter) continues to work — the new auto-grant merges with any OnPermissions already declared.

…ation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…d label_command on pull_request events Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-08T12:57:41Z

🤖 PR Triage

Field	Value
Category	`bug`
Risk	🟡 `medium`
Score	60 / 100
Recommended action	⚡ `fast_track`

Score breakdown: Impact 28 + Urgency 18 + Quality 14

Assessment: Fixes silent job-skip when label_command: decentralized is used on pull_request events — 403 on GET /pulls/{number} caused all downstream jobs to silently not run. Targeted compiler fix + test. Draft — needs undraft.

Next step: Author to undraft, confirm CI, then fast-track.

Generated by 🔧 PR Triage Agent · 64.6 AIC · ⌖ 20.4 AIC · ⊞ 5.4K · ◷

Copilot

Pull request overview

This PR updates the gh-aw workflow compiler so that workflows using label_command with strategy: decentralized on pull_request events automatically grant pull-requests: read to the compiled pre_activation job, preventing 403s in the PR provenance check and avoiding silent downstream job skips.

Changes:

Compiler: auto-add pull-requests: read to pre_activation when decentralized label_command includes pull_request.
Tests: add coverage asserting the generated pre_activation permissions contain pull-requests: read for that configuration.
Recompiled multiple generated workflow lock files (including the decentralized label-command workflows noted in the PR description).

Show a summary per file

File	Description
pkg/workflow/compiler_pre_activation_job.go	Auto-grants `pull-requests: read` in `pre_activation` for decentralized `label_command` workflows that include `pull_request` events.
pkg/workflow/label_command_test.go	Adds a regression test asserting `pre_activation` includes `pull-requests: read` for decentralized `label_command` with `pull_request`.
.github/workflows/workflow-generator.lock.yml	Recompiled lock file (also contains additional generated step changes).
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Recompiled lock file (also contains additional generated step changes).
.github/workflows/weekly-issue-summary.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/weekly-blog-post-writer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/stale-repo-identifier.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-copilot.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-copilot-aoai-entra.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-copilot-aoai-apikey.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-agent-scoped-approved.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-agent-public-none.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-agent-public-approved.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-agent-all-none.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/smoke-agent-all-merged.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/skillet.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/security-review.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/scout.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/refiner.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/q.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/pr-triage-agent.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/pr-sous-chef.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/pr-nitpick-reviewer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/pr-code-quality-reviewer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/plan.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/org-health-report.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/necromancer.lock.yml	Recompiled lock file (adds `pull-requests: read` to `pre_activation`).
.github/workflows/mattpocock-skills-reviewer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/issue-triage-agent.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/issue-monster.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/issue-arborist.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/impeccable-skills-reviewer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/grumpy-reviewer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/discussion-task-miner.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/dev.lock.yml	Recompiled lock file (adds `pull-requests: read` to `pre_activation`).
.github/workflows/dataflow-pr-discussion-dataset.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/daily-team-status.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/daily-issues-report.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/daily-doc-updater.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/contribution-check.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/cloclo.lock.yml	Recompiled lock file (adds `pull-requests: read` to `pre_activation`).
.github/workflows/ci-doctor.lock.yml	Recompiled lock file (adds `pull-requests: read` to `pre_activation`).
.github/workflows/auto-triage-issues.lock.yml	Recompiled lock file (generated content updates).
.github/workflows/approach-validator.lock.yml	Recompiled lock file (adds `pull-requests: read` to `pre_activation`).
.github/workflows/ai-moderator.lock.yml	Recompiled lock file (generated content updates).

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 46/46 changed files
Comments generated: 2
Review effort level: Low

      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.27 --rootless
-      - name: Determine automatic lockdown mode for GitHub MCP Server
-        id: determine-automatic-lockdown
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
-        env:
-          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
-          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
-          GH_AW_GITHUB_MIN_INTEGRITY: 'approved'
-        with:
-          script: |
-            const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
-            await determineAutomaticLockdown(github, context, core);
      - name: Parse integrity filter lists


      - name: Install AWF binary
        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.27 --rootless
-      - name: Determine automatic lockdown mode for GitHub MCP Server
-        id: determine-automatic-lockdown
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
-        env:
-          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
-          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
-          GH_AW_GITHUB_MIN_INTEGRITY: 'approved'
-        with:
-          script: |
-            const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
-            await determineAutomaticLockdown(github, context, core);
      - name: Parse integrity filter lists


pelikhan · 2026-07-08T13:15:05Z

@copilot run pr-finisher skill

… step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-08T13:31:12Z

@copilot run pr-finisher skill

Fixed in 71c7e85. The reviewer-flagged issue (missing determine-automatic-lockdown step referenced in workflow-generator.lock.yml and weekly-safe-outputs-spec-review.lock.yml) was caused by those lock files being compiled with an older compiler version that didn't yet emit that step. Running make recompile after the merge from main (which updated compiler_github_mcp_steps.go) regenerated all 39 affected lock files with the step correctly in place. Local validation passes: make fmt, make test-unit, and make agent-report-progress all green.

github-actions · 2026-07-09T04:05:23Z

🎉 This pull request is included in a new release.

Release: v0.82.7

Initial plan

f6ea25b

Copilot AI assigned Copilot and pelikhan Jul 8, 2026

Copilot started work on behalf of pelikhan July 8, 2026 12:06 View session

Copilot AI linked an issue Jul 8, 2026 that may be closed by this pull request

Compiler should auto-grant pull-requests:read to pre_activation for decentralized label_command on pull_request events #44247

Closed

Copilot AI and others added 2 commits July 8, 2026 12:12

chore: initial plan for auto-granting pull-requests:read to pre_activ…

0082d47

…ation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: auto-grant pull-requests:read to pre_activation for decentralize…

b07e89f

…d label_command on pull_request events Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix compiler to auto-grant pull-requests:read for pre_activation job~~ Compiler: auto-grant pull-requests:read to pre_activation for decentralized label_command on pull_request events Jul 8, 2026

Copilot AI requested a review from pelikhan July 8, 2026 12:24

Copilot finished work on behalf of pelikhan July 8, 2026 12:24

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:medium pr-risk:medium pr-type:bug labels Jul 8, 2026

This was referenced Jul 8, 2026

fix: reclaim root-owned sandbox firewall dirs to prevent EACCES on reused runners #44276

Merged

[PR Triage Report] PR Triage Report — 2026-07-08 (run 28943607052) #44293

Closed

pelikhan marked this pull request as ready for review July 8, 2026 12:59

Copilot AI review requested due to automatic review settings July 8, 2026 12:59

Copilot started reviewing on behalf of pelikhan July 8, 2026 13:00 View session

Merge branch 'main' into copilot/fix-pull-requests-permissions

7e323ec

Copilot AI reviewed Jul 8, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 8, 2026 13:15 View session

fix: recompile lock files to add missing determine-automatic-lockdown…

71c7e85

… step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 8, 2026 13:31

pelikhan merged commit b3a396d into main Jul 8, 2026
29 checks passed

pelikhan deleted the copilot/fix-pull-requests-permissions branch July 8, 2026 13:59

github-actions Bot mentioned this pull request Jul 8, 2026

[PR Triage Report] PR Triage Report — 2026-07-08 [§28966928999] #44396

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Compiler: auto-grant pull-requests:read to pre_activation for decentralized label_command on pull_request events#44282

Compiler: auto-grant pull-requests:read to pre_activation for decentralized label_command on pull_request events#44282
pelikhan merged 5 commits into
mainfrom
copilot/fix-pull-requests-permissions

Copilot AI commented Jul 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented Jul 8, 2026

Uh oh!

Copilot AI commented Jul 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Before / After

Uh oh!

github-actions Bot commented Jul 8, 2026

🤖 PR Triage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Jul 8, 2026

Uh oh!

Copilot AI commented Jul 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 8, 2026 •

edited

Loading