Fix agentic threat-detection auth by recompiling pat_pool workflows with gh-aw v0.82.6#131156
Merged
matouskozak merged 2 commits intoJul 22, 2026
Merged
Conversation
The threat-detection job of the pat_pool-based agentic workflows could not authenticate to Copilot, producing spurious "agentic threat detected / the results could not be parsed" warn-mode banners (e.g. dotnet#131122). Root cause: gh-aw v0.81.6 omitted custom needs.* jobs (here pat_pool) from the auto-generated threat-detection job's needs:. With pat_pool absent from needs, needs.pat_pool.outputs.pat_number was empty, the COPILOT_GITHUB_TOKEN case() expression fell through to the literal 'NO COPILOT PAT AVAILABLE', and the detection agent got 503s and emitted no THREAT_DETECTION_RESULT. github/gh-aw#44202 (first released in v0.82.6) wires those jobs into the detection job's needs. Recompile the five workflows still on v0.81.6 with gh-aw v0.82.6 (holistic-review was already migrated). Also flatten COPILOT_GITHUB_TOKEN onto a single line in each source: v0.82.6 emits it into a new "Check for OAuth tokens" activation step whose generated YAML is invalid when the expression spans multiple lines. - ci-failure-scan, ci-failure-fix, ci-failure-scan-feedback, breaking-change-doc, closed-issue-reference-check: detection job now depends on pat_pool. - agentics-maintenance.yml: regenerated (gh-aw v0.81.6 -> v0.82.6). - shared/pat_pool.README.md: document the single-line requirement. Compiled with: gh aw compile --schedule-seed dotnet/runtime Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6cc26dce-fd72-4722-89f6-e7a868bc9692
|
Azure Pipelines: Successfully started running 1 pipeline(s). 15 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/area-meta |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates several agentic workflows that rely on the shared pat_pool job, regenerating their compiled *.lock.yml files so the generated detection job correctly depends on pat_pool and can resolve needs.pat_pool.outputs.pat_number for Copilot PAT selection.
Changes:
- Flattened the
COPILOT_GITHUB_TOKENcase(...)expression to a single line in the affected workflow sources (and updated the shared README note). - Recompiled the affected workflows with a newer gh-aw toolchain, updating generated
*.lock.ymlcontent (includingdetection.needsto includepat_pool). - Regenerated
agentics-maintenance.ymlas part of the gh-aw recompile/tooling update.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/shared/pat_pool.README.md | Updates guidance and the COPILOT_GITHUB_TOKEN example to the single-line form. |
| .github/workflows/ci-failure-scan.md | Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source. |
| .github/workflows/ci-failure-scan.lock.yml | Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output. |
| .github/workflows/ci-failure-scan-feedback.md | Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source. |
| .github/workflows/ci-failure-scan-feedback.lock.yml | Regenerated workflow consistent with the newer gh-aw output (including detection.needs changes). |
| .github/workflows/ci-failure-fix.md | Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source. |
| .github/workflows/ci-failure-fix.lock.yml | Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output. |
| .github/workflows/closed-issue-reference-check.md | Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source. |
| .github/workflows/closed-issue-reference-check.lock.yml | Regenerated workflow consistent with the newer gh-aw output (including detection.needs changes). |
| .github/workflows/breaking-change-doc.md | Flattens COPILOT_GITHUB_TOKEN expression to a single line in the workflow source. |
| .github/workflows/breaking-change-doc.lock.yml | Regenerated workflow; detection job now includes pat_pool in needs: and incorporates newer gh-aw output. |
| .github/workflows/agentics-maintenance.yml | Regenerated maintenance workflow to the newer gh-aw version output. |
…README.md These were byproducts of a bare `gh aw compile` (maintenance-workflow regeneration) and a doc edit, both orthogonal to the threat-detection fix. Reverting to keep the PR scoped to the 5 workflows whose detection job needed `pat_pool`. The repo already tolerates mixed gh-aw versions (holistic-review is v0.82.6 while agentics-maintenance stays v0.81.6), so no consistency is lost. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6cc26dce-fd72-4722-89f6-e7a868bc9692
|
Azure Pipelines: Successfully started running 1 pipeline(s). 15 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
vitek-karas
approved these changes
Jul 21, 2026
kotlarmilos
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agentic workflows that use the shared
pat_pooljob show a false-positive "agentic threat detected / results could not be parsed" banner (e.g. #131122) — the threat-detection job simply can't authenticate.Cause: under gh-aw v0.81.6, the generated
detectionjob'sneeds:is hardcoded to[activation, agent]and omits the custompat_pooljob. Soneeds.pat_pool.outputs.pat_numberis empty,COPILOT_GITHUB_TOKENfalls back to'NO COPILOT PAT AVAILABLE', inference returns 503, and noTHREAT_DETECTION_RESULTis emitted. Fixed upstream in v0.82.6 (github/gh-aw#44202);holistic-reviewalready runs v0.82.6 without the bug.Fix: recompiled the 5 affected workflows with gh-aw v0.82.6. Each
detectionjob now depends onpat_pool:detection: needs: - activation - agent + - pat_poolThe
.mdCOPILOT_GITHUB_TOKENis flattened to a single line because v0.82.6's newCheck for OAuth tokensstep emits invalid YAML from a multiline value (same asholistic-review.md).