Create new sandbox pre-check action - #515
Merged
Merged
Conversation
Runs the GitHub Copilot CLI against newly opened [Sandbox] issues to validate applications against the Sandbox acceptance criteria and the CNCF TOC Principles. Clear violations (incompatible license, project under 6 months old, reference architecture, invalid MAINTAINERS link, or an empty application) receive the Postponed label plus an explanatory comment; passing applications receive an advisory assessment comment for TOC reviewers. Requires a COPILOT_GITHUB_TOKEN fine-grained PAT secret with the Copilot Requests permission. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
Copilot CLI in Actions now supports the built-in GITHUB_TOKEN with the copilot-requests: write permission, billing usage to the organization's pooled Copilot credits instead of an individual seat. Replace the COPILOT_GITHUB_TOKEN PAT secret accordingly and update the docs. Also remove .github/workflows.yml: it has sat outside the workflows/ directory since 2022 and never executed. Its purpose (labeling new applications with New) is already handled by the application issue form, and if activated it would mislabel automation-created onboarding issues. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
The project itself must be Apache 2.0; the CNCF allowlist applies to dependencies, not the project license. Any other project license is a violation unless a Governing Board license exception is referenced. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
Enable the url tool so the review can verify claims instead of only reading the application text: repository license via the GitHub API and raw LICENSE file, repository age via created_at, and the MAINTAINERS file contents (existence and required affiliation columns). Fetched content is treated as untrusted, fetches are limited to URLs listed in the application, and a failed fetch is reported as a concern rather than a violation. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
jeefy
requested review from
angellk,
kevin-wangzefeng,
krook,
mrbobbytables and
riaankleinhans
August 19, 2026 19:45
riaankleinhans
approved these changes
Aug 19, 2026
Contributor
|
Great tool @jeefy |
krook
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creates a new GitHub Action that invokes Copilot to sanity-check each new Sandbox application. It is only ever invoked once (during issue creation) and the bot creates a comment with its findings.
Example:
(Also there was a workflow.yml file that was located incorrectly and hasn't been invoked in years so yeet)