Skip to content

Fix agentic threat-detection auth by recompiling pat_pool workflows with gh-aw v0.82.6#131156

Merged
matouskozak merged 2 commits into
dotnet:mainfrom
matouskozak:matouskozak-fix-detection-job-pat-pool
Jul 22, 2026
Merged

Fix agentic threat-detection auth by recompiling pat_pool workflows with gh-aw v0.82.6#131156
matouskozak merged 2 commits into
dotnet:mainfrom
matouskozak:matouskozak-fix-detection-job-pat-pool

Conversation

@matouskozak

@matouskozak matouskozak commented Jul 21, 2026

Copy link
Copy Markdown
Member

Agentic workflows that use the shared pat_pool job show a false-positive "agentic threat detected / results could not be parsed" banner (e.g. #131122) — the threat-detection job simply can't authenticate.

Cause: under gh-aw v0.81.6, the generated detection job's needs: is hardcoded to [activation, agent] and omits the custom pat_pool job. So needs.pat_pool.outputs.pat_number is empty, COPILOT_GITHUB_TOKEN falls back to 'NO COPILOT PAT AVAILABLE', inference returns 503, and no THREAT_DETECTION_RESULT is emitted. Fixed upstream in v0.82.6 (github/gh-aw#44202); holistic-review already runs v0.82.6 without the bug.

Fix: recompiled the 5 affected workflows with gh-aw v0.82.6. Each detection job now depends on pat_pool:

   detection:
     needs:
       - activation
       - agent
+      - pat_pool

The .md COPILOT_GITHUB_TOKEN is flattened to a single line because v0.82.6's new Check for OAuth tokens step emits invalid YAML from a multiline value (same as holistic-review.md).

The threat-detection job of the pat_pool-based agentic workflows could not
authenticate to Copilot, producing spurious "agentic threat detected / the
results could not be parsed" warn-mode banners (e.g. dotnet#131122).

Root cause: gh-aw v0.81.6 omitted custom needs.* jobs (here pat_pool) from the
auto-generated threat-detection job's needs:. With pat_pool absent from needs,
needs.pat_pool.outputs.pat_number was empty, the COPILOT_GITHUB_TOKEN case()
expression fell through to the literal 'NO COPILOT PAT AVAILABLE', and the
detection agent got 503s and emitted no THREAT_DETECTION_RESULT. github/gh-aw#44202
(first released in v0.82.6) wires those jobs into the detection job's needs.

Recompile the five workflows still on v0.81.6 with gh-aw v0.82.6 (holistic-review
was already migrated). Also flatten COPILOT_GITHUB_TOKEN onto a single line in each
source: v0.82.6 emits it into a new "Check for OAuth tokens" activation step whose
generated YAML is invalid when the expression spans multiple lines.

- ci-failure-scan, ci-failure-fix, ci-failure-scan-feedback, breaking-change-doc,
  closed-issue-reference-check: detection job now depends on pat_pool.
- agentics-maintenance.yml: regenerated (gh-aw v0.81.6 -> v0.82.6).
- shared/pat_pool.README.md: document the single-line requirement.

Compiled with: gh aw compile --schedule-seed dotnet/runtime

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6cc26dce-fd72-4722-89f6-e7a868bc9692
Copilot AI review requested due to automatic review settings July 21, 2026 15:47
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/area-meta
See info in area-owners.md if you want to be subscribed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates several agentic workflows that rely on the shared pat_pool job, regenerating their compiled *.lock.yml files so the generated detection job correctly depends on pat_pool and can resolve needs.pat_pool.outputs.pat_number for Copilot PAT selection.

Changes:

  • Flattened the COPILOT_GITHUB_TOKEN case(...) expression to a single line in the affected workflow sources (and updated the shared README note).
  • Recompiled the affected workflows with a newer gh-aw toolchain, updating generated *.lock.yml content (including detection.needs to include pat_pool).
  • Regenerated agentics-maintenance.yml as part of the gh-aw recompile/tooling update.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
.github/workflows/shared/pat_pool.README.md Updates guidance and the COPILOT_GITHUB_TOKEN example to the single-line form.
.github/workflows/ci-failure-scan.md Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source.
.github/workflows/ci-failure-scan.lock.yml Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output.
.github/workflows/ci-failure-scan-feedback.md Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source.
.github/workflows/ci-failure-scan-feedback.lock.yml Regenerated workflow consistent with the newer gh-aw output (including detection.needs changes).
.github/workflows/ci-failure-fix.md Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source.
.github/workflows/ci-failure-fix.lock.yml Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output.
.github/workflows/closed-issue-reference-check.md Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source.
.github/workflows/closed-issue-reference-check.lock.yml Regenerated workflow consistent with the newer gh-aw output (including detection.needs changes).
.github/workflows/breaking-change-doc.md Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source.
.github/workflows/breaking-change-doc.lock.yml Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output.
.github/workflows/agentics-maintenance.yml Regenerated maintenance workflow to the newer gh-aw version output.

Comment thread .github/workflows/shared/pat_pool.README.md Outdated
…README.md

These were byproducts of a bare `gh aw compile` (maintenance-workflow
regeneration) and a doc edit, both orthogonal to the threat-detection fix.
Reverting to keep the PR scoped to the 5 workflows whose detection job needed
`pat_pool`. The repo already tolerates mixed gh-aw versions (holistic-review is
v0.82.6 while agentics-maintenance stays v0.81.6), so no consistency is lost.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6cc26dce-fd72-4722-89f6-e7a868bc9692
Copilot AI review requested due to automatic review settings July 21, 2026 16:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Comment thread .github/workflows/ci-failure-scan.lock.yml
@matouskozak
matouskozak marked this pull request as ready for review July 21, 2026 16:49
@matouskozak
matouskozak requested review from a team and jeffhandley as code owners July 21, 2026 16:49
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@matouskozak
matouskozak merged commit 23860fb into dotnet:main Jul 22, 2026
31 checks passed
@matouskozak
matouskozak deleted the matouskozak-fix-detection-job-pat-pool branch July 22, 2026 06:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants