From a1b00fd03b7dffde2c237faa7092e2252e969034 Mon Sep 17 00:00:00 2001 From: Hayden <154503486+groupthinking@users.noreply.github.com> Date: Fri, 31 Jul 2026 00:28:00 -0500 Subject: [PATCH 1/2] fix(aw): require an explicit noop terminal state in agentic workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The EventRelay CI Investigator has auto-filed 54 "[aw] ... produced no safe outputs" issues, 6 of which are still open (#1091, #1042, #1019, #978, #964, #950). They are not real findings — they are the workflow reporting on its own silence. Root cause is a contradiction between the prompt and the harness: - The harness treats a run that emits zero safe outputs as a failure and files a tracking issue. Its own warning says "The agent should have called `noop` to explicitly indicate no action was taken." - `noop` is available: the compiler auto-injects it (`max: 1`, required `message` field) and the runtime prompt advertises it in ``. - But the workflow body never mentioned `noop` — zero occurrences — while actively instructing the agent to go silent: "Never create duplicate issues/comments for unchanged healthy state." "Exit before expensive analysis if preflight detects no state change." So on every healthy, unchanged CI run the agent did exactly what it was told, emitted nothing, and the harness filed a bogus issue. The workflow was guaranteed to generate noise precisely when the repository was healthy. Add an explicit terminal-state contract: a run must always emit at least one safe output, and the no-action paths must terminate with `noop` plus a one-line reason rather than returning silently. The two silent-exit constraints are amended to route through `noop`. The same contract is added to canonical-pr-remediator and focused-coverage-controller. Neither has manifested the failure yet, but both run on the identical harness with `noop` advertised and no guidance to call it, so both carry the same latent defect. Lock files recompiled with the CI-pinned compiler (gh aw v0.82.14). Only `body_hash` changes in each lock; `frontmatter_hash` and `compiler_version` are unchanged, confirming no configuration drift. Closes #1091 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../canonical-pr-remediator.lock.yml | 2 +- .github/workflows/canonical-pr-remediator.md | 16 ++++++++++++++ .../eventrelay-ci-investigator.lock.yml | 2 +- .../workflows/eventrelay-ci-investigator.md | 22 +++++++++++++++++-- .../focused-coverage-controller.lock.yml | 2 +- .../workflows/focused-coverage-controller.md | 16 ++++++++++++++ 6 files changed, 55 insertions(+), 5 deletions(-) diff --git a/.github/workflows/canonical-pr-remediator.lock.yml b/.github/workflows/canonical-pr-remediator.lock.yml index f6d398408..23ca7284c 100644 --- a/.github/workflows/canonical-pr-remediator.lock.yml +++ b/.github/workflows/canonical-pr-remediator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"34a7466d6c5cdcc62b5f750959ba94c29bd1616262c5a8eddbae9d01011d6e83","body_hash":"6514dad4af8ea5d3df54b447c3a6a6ecec2c4cd7cb16f79fb2ae1fe38b42ed2a","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"34a7466d6c5cdcc62b5f750959ba94c29bd1616262c5a8eddbae9d01011d6e83","body_hash":"016b9a92d28631cac6863ba3f3483610fdfc75aeba5764a43993e3eca739a061","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/canonical-pr-remediator.md b/.github/workflows/canonical-pr-remediator.md index 7b6bd6995..4f776eb84 100644 --- a/.github/workflows/canonical-pr-remediator.md +++ b/.github/workflows/canonical-pr-remediator.md @@ -62,3 +62,19 @@ Return an in-depth remediation report that includes: - bounded patch plan (or explicit no-op) - test/check plan tied to the new head - why no unsafe action was taken + +## Terminal state contract + +Every run MUST finish by emitting at least one safe output. A run that emits +nothing is not read as "healthy": the harness classifies it as `produced no +safe outputs` and files a tracking issue, so silence produces noise instead of +signal. + +When the correct outcome is to take no action -- healthy CI, unchanged state, a +canceled or superseded run, or a preflight early exit -- call `noop` with a +one-line reason instead of returning silently. `noop` is the explicit, +deduplicated "nothing to do" record and is always the correct terminal state +for a no-change run. + +Skip `noop` only when you have already emitted another safe output +(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index 550e95a7e..40658848a 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"61f9bc77605dd935bb802e16370d8f7c3133312581fd4dd8c44286c140faaba4","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/eventrelay-ci-investigator.md b/.github/workflows/eventrelay-ci-investigator.md index 58c9f9d64..ce1a86e1c 100644 --- a/.github/workflows/eventrelay-ci-investigator.md +++ b/.github/workflows/eventrelay-ci-investigator.md @@ -83,10 +83,28 @@ Publish one deduplicated blocker update that includes: ## Behavioral constraints -- Never create duplicate issues/comments for unchanged healthy state. -- Exit before expensive analysis if preflight detects no state change. +- Never create duplicate issues/comments for unchanged healthy state; + record that state with `noop` instead. +- Exit before expensive analysis if preflight detects no state change, and + emit `noop` on that path rather than exiting silently. - Keep response report-first, deterministic, and SHA-bound. +## Terminal state contract + +Every run MUST finish by emitting at least one safe output. A run that emits +nothing is not read as "healthy": the harness classifies it as `produced no +safe outputs` and files a tracking issue, so silence produces noise instead of +signal. + +When the correct outcome is to take no action -- healthy CI, unchanged state, a +canceled or superseded run, or a preflight early exit -- call `noop` with a +one-line reason instead of returning silently. `noop` is the explicit, +deduplicated "nothing to do" record and is always the correct terminal state +for a no-change run. + +Skip `noop` only when you have already emitted another safe output +(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). + ## Jules reporting requirement Return a detailed completion report with: diff --git a/.github/workflows/focused-coverage-controller.lock.yml b/.github/workflows/focused-coverage-controller.lock.yml index 349b8d445..aa42e2da7 100644 --- a/.github/workflows/focused-coverage-controller.lock.yml +++ b/.github/workflows/focused-coverage-controller.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"df33ebc8485a32f06deee2d6380ca71cfce81ba2cb8ec1c48d6a2e621c364c53","body_hash":"423fb9a3df19a84b185977bd53f9f7a46bd4f70633766742d313a0949f476693","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"df33ebc8485a32f06deee2d6380ca71cfce81ba2cb8ec1c48d6a2e621c364c53","body_hash":"d5d8662a7f477128a4aeb44052e0614c67672dd072a2d98018f8c71101d36c98","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/focused-coverage-controller.md b/.github/workflows/focused-coverage-controller.md index 0c86f2d6f..8a3a35e67 100644 --- a/.github/workflows/focused-coverage-controller.md +++ b/.github/workflows/focused-coverage-controller.md @@ -85,3 +85,19 @@ Return an in-depth status report with: - exact failing or passing gate names - smallest next test-only increment - explicit stop reason if prerequisites are missing + +## Terminal state contract + +Every run MUST finish by emitting at least one safe output. A run that emits +nothing is not read as "healthy": the harness classifies it as `produced no +safe outputs` and files a tracking issue, so silence produces noise instead of +signal. + +When the correct outcome is to take no action -- healthy CI, unchanged state, a +canceled or superseded run, or a preflight early exit -- call `noop` with a +one-line reason instead of returning silently. `noop` is the explicit, +deduplicated "nothing to do" record and is always the correct terminal state +for a no-change run. + +Skip `noop` only when you have already emitted another safe output +(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). From ba5591799990c2770de9a543e9cfbe086af66882 Mon Sep 17 00:00:00 2001 From: Hayden <154503486+groupthinking@users.noreply.github.com> Date: Fri, 31 Jul 2026 00:41:15 -0500 Subject: [PATCH 2/2] fix(aw): scope the noop skip rule by property, not a hardcoded tool list Review caught that the skip clause enumerated safe outputs, which was wrong twice over: 1. It omitted `missing_tool` and `missing_data`. Both are safe outputs, so a run that emits one already satisfies the harness. The clause would have told the agent to emit `noop` as well -- a contradictory double signal on a run that had in fact reported something. 2. It named `create_issue`, `update_issue` and `create_check_run` in canonical-pr-remediator and focused-coverage-controller, which expose only `add_comment, missing_tool, missing_data, noop`. Those two prompts therefore referenced tools the agent does not have -- the same class of prompt/harness mismatch this PR exists to fix. Replace the enumeration with a property-based rule: skip `noop` when the run has already emitted any other safe output, and never pair `noop` with another safe output. This is correct for all three workflows and cannot drift as the per-workflow tool set changes. Recompiled with the CI-pinned compiler (gh aw v0.82.14): one line per lock, `body_hash` only; `frontmatter_hash` and `compiler_version` unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/canonical-pr-remediator.lock.yml | 2 +- .github/workflows/canonical-pr-remediator.md | 7 +++++-- .github/workflows/eventrelay-ci-investigator.lock.yml | 2 +- .github/workflows/eventrelay-ci-investigator.md | 7 +++++-- .github/workflows/focused-coverage-controller.lock.yml | 2 +- .github/workflows/focused-coverage-controller.md | 7 +++++-- 6 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.github/workflows/canonical-pr-remediator.lock.yml b/.github/workflows/canonical-pr-remediator.lock.yml index 23ca7284c..8d2c1da10 100644 --- a/.github/workflows/canonical-pr-remediator.lock.yml +++ b/.github/workflows/canonical-pr-remediator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"34a7466d6c5cdcc62b5f750959ba94c29bd1616262c5a8eddbae9d01011d6e83","body_hash":"016b9a92d28631cac6863ba3f3483610fdfc75aeba5764a43993e3eca739a061","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"34a7466d6c5cdcc62b5f750959ba94c29bd1616262c5a8eddbae9d01011d6e83","body_hash":"676a80cd6e17b56d77f49bebcb5bad00b593971642c0a0a9f0cd64d94e896cc7","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/canonical-pr-remediator.md b/.github/workflows/canonical-pr-remediator.md index 4f776eb84..e2946f805 100644 --- a/.github/workflows/canonical-pr-remediator.md +++ b/.github/workflows/canonical-pr-remediator.md @@ -76,5 +76,8 @@ one-line reason instead of returning silently. `noop` is the explicit, deduplicated "nothing to do" record and is always the correct terminal state for a no-change run. -Skip `noop` only when you have already emitted another safe output -(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). +Skip `noop` only when the run has already emitted some other safe output. Any +safe output satisfies the requirement, including `missing_tool` and +`missing_data` -- those are themselves valid terminal states, so a run that +reports one is already accounted for and must not also emit `noop`. Never pair +`noop` with another safe output in the same run. diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index 40658848a..9b29ea3e9 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"61f9bc77605dd935bb802e16370d8f7c3133312581fd4dd8c44286c140faaba4","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"dc8dbbd3b355dc9093fd3407964c771be90496c91c24bbb9c7f069d5c6092352","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/eventrelay-ci-investigator.md b/.github/workflows/eventrelay-ci-investigator.md index ce1a86e1c..8bdc2dbce 100644 --- a/.github/workflows/eventrelay-ci-investigator.md +++ b/.github/workflows/eventrelay-ci-investigator.md @@ -102,8 +102,11 @@ one-line reason instead of returning silently. `noop` is the explicit, deduplicated "nothing to do" record and is always the correct terminal state for a no-change run. -Skip `noop` only when you have already emitted another safe output -(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). +Skip `noop` only when the run has already emitted some other safe output. Any +safe output satisfies the requirement, including `missing_tool` and +`missing_data` -- those are themselves valid terminal states, so a run that +reports one is already accounted for and must not also emit `noop`. Never pair +`noop` with another safe output in the same run. ## Jules reporting requirement diff --git a/.github/workflows/focused-coverage-controller.lock.yml b/.github/workflows/focused-coverage-controller.lock.yml index aa42e2da7..f9284e8ca 100644 --- a/.github/workflows/focused-coverage-controller.lock.yml +++ b/.github/workflows/focused-coverage-controller.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"df33ebc8485a32f06deee2d6380ca71cfce81ba2cb8ec1c48d6a2e621c364c53","body_hash":"d5d8662a7f477128a4aeb44052e0614c67672dd072a2d98018f8c71101d36c98","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"df33ebc8485a32f06deee2d6380ca71cfce81ba2cb8ec1c48d6a2e621c364c53","body_hash":"f23620f9382f8d6b25181a37d0b8723fab71e904a6c42c20228d0401db946257","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # diff --git a/.github/workflows/focused-coverage-controller.md b/.github/workflows/focused-coverage-controller.md index 8a3a35e67..2fbddc765 100644 --- a/.github/workflows/focused-coverage-controller.md +++ b/.github/workflows/focused-coverage-controller.md @@ -99,5 +99,8 @@ one-line reason instead of returning silently. `noop` is the explicit, deduplicated "nothing to do" record and is always the correct terminal state for a no-change run. -Skip `noop` only when you have already emitted another safe output -(`add_comment`, `create_issue`, `update_issue`, or `create_check_run`). +Skip `noop` only when the run has already emitted some other safe output. Any +safe output satisfies the requirement, including `missing_tool` and +`missing_data` -- those are themselves valid terminal states, so a run that +reports one is already accounted for and must not also emit `noop`. Never pair +`noop` with another safe output in the same run.