ci: install pinned gh-aw canary and make coverage authoritative - #921
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
16 tasks
Copilot
AI
changed the title
[WIP] Fix gh-aw runtime and workflow validation issues
Harden gh-aw governance activation and make coverage gate authoritative
Jul 22, 2026
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
…ia `env` in job-level `if` conditions, where the `env` context is unavailable, so both jobs always evaluate to false and never run. This commit fixes the issue reported at .github/workflows/dependabot-auto-merge.yml:21 ## Bug In `.github/workflows/dependabot-auto-merge.yml`, both the `approve` and `merge` jobs gated their execution on: ```yaml if: env.DEPENDABOT_AUTO_MERGE_ENABLED == 'true' && ... ``` Per GitHub Actions' [context availability rules](https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability), the `env` context is **not** available in `jobs.<job_id>.if`. Only `github`, `needs`, `vars`, and `inputs` contexts can be referenced at the job level; `env` is only available within steps (`jobs.<job_id>.steps.<step_id>.if` and step values). When an unavailable context is referenced in an expression, it evaluates to an empty string. So the guard became: ``` '' == 'true' → false ``` **Failure mode / trigger:** Even if a maintainer sets `DEPENDABOT_AUTO_MERGE_ENABLED` to `"true"` (whether as the workflow-level env default or otherwise), the job-level `if` still reads the empty `env` context, so both `approve` and `merge` jobs are permanently skipped. The feature flag is completely inert — auto-merge can never be enabled. ## Fix Switched the flag to the `vars` context, which **is** available in job-level `if`: ```yaml if: vars.DEPENDABOT_AUTO_MERGE_ENABLED == 'true' && ... ``` This makes the flag a repository/organization variable. When the variable is unset (the default), `vars.DEPENDABOT_AUTO_MERGE_ENABLED` is `''`, so the jobs remain disabled — preserving the intended fail-safe/off-by-default behavior. Setting the repo variable to `true` now actually enables the workflow. The previous workflow-level `env` block (`DEPENDABOT_AUTO_MERGE_ENABLED: "false"`) was removed because it was dead — it could never influence the job-level conditions and was misleading. The unit test `tests/unit/test_dependabot_automation_workflow.py` was updated to assert the `vars.` form and to verify the flag is not (re)introduced as a workflow-level `env` value. Note the original test only checked for the literal string in the `if` condition and did not validate functional behavior, which is why it never caught the bug. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com> Co-authored-by: groupthinking <garveyht@gmail.com>
🔍 PR Validation |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. OpenSSF Scorecard
Scanned Files
|
groupthinking
changed the title
Agent Completion Truth Gate: BLOCKEDReasons: Machine-readable verdict{
"details": {
"invalid_fields": [
"policy.agent_login",
"policy.run_id"
]
},
"reasons": [
"invalid_payload"
],
"verdict": "blocked"
} |
groupthinking
approved these changes
Jul 22, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Installs pinned gh-aw canary workflows, makes Python coverage failures authoritative, and pauses Dependabot auto-merge.
Changes:
- Adds three report-only Codex workflows and generated lock files.
- Enforces the 90% coverage threshold.
- Adds gh-aw validation, governance tests, and workflow documentation.
Reviewed changes
Copilot reviewed 14 out of 17 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
.gitattributes |
Marks generated lock workflows. |
.github/agentic/verification-loop.aw.yml |
Removes obsolete agent workflow. |
.github/aw/actions-lock.json |
Pins gh-aw setup action. |
.github/workflows/AUDIT.md |
Records validation workflow. |
.github/workflows/README.md |
Documents validation and coverage. |
.github/workflows/canonical-pr-remediator.lock.yml |
Generated remediator workflow. |
.github/workflows/canonical-pr-remediator.md |
Defines report-only remediation. |
.github/workflows/coverage.yml |
Enforces coverage failures. |
.github/workflows/dependabot-auto-merge.yml |
Adds auto-merge feature gate. |
.github/workflows/eventrelay-ci-investigator.lock.yml |
Generated investigator workflow. |
.github/workflows/eventrelay-ci-investigator.md |
Defines CI investigation behavior. |
.github/workflows/focused-coverage-controller.lock.yml |
Generated coverage controller. |
.github/workflows/focused-coverage-controller.md |
Defines coverage reporting behavior. |
.github/workflows/gh-aw-validation.yml |
Compiles and validates gh-aw sources. |
.github/workflows/verification.yml |
Updates legacy workflow comments. |
tests/unit/test_dependabot_automation_workflow.py |
Tests the auto-merge gate. |
tests/unit/test_gh_aw_workflow_governance.py |
Tests coverage and gh-aw governance. |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v7 |
Comment on lines
+12
to
+13
| branches: | ||
| - main |
|
|
||
| # EventRelay CI Investigator (report-first) | ||
|
|
||
| You are Jules running the EventRelay CI Investigator. |
Comment on lines
+61
to
+63
| ## Output contract (single deduplicated blocker record) | ||
|
|
||
| Publish one deduplicated blocker update that includes: |
Comment on lines
19
to
21
| | `coverage.yml` | **FIX** | Added a top-level `name:` and the `workflow_dispatch` trigger the README already documented as available. | | ||
| | `gh-aw-validation.yml` | **ADD** | Adds pinned gh-aw (`v0.82.14`) validation for EventRelay's custom markdown workflows. Enforces compile/validate plus actionlint, zizmor, and poutine checks, and verifies committed lock files. | | ||
| | `dependabot-auto-merge.yml` | KEEP | Comprehensive guards (same-repo, non-draft, SHA match, major excluded). | |
| jobs: | ||
| approve: | ||
| if: >- | ||
| vars.DEPENDABOT_AUTO_MERGE_ENABLED == 'true' && |
Comment on lines
+17
to
+21
| actions: read | ||
| checks: read | ||
| contents: read | ||
| issues: read | ||
| pull-requests: read |
Comment on lines
+7
to
+11
| actions: read | ||
| checks: read | ||
| contents: read | ||
| issues: read | ||
| pull-requests: read |
| --cov-report=html:reports/htmlcov \ | ||
| --cov-fail-under=0 \ | ||
| -v || true | ||
| --cov-fail-under=90 \ |
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
Draft — implementation exists, but exact-head workflows have not been authorized to run. Do not merge or activate the agents yet.
Canonical scope
Focused issue: #920
Parent program: #898
Related governance PR: #899 remains the canonical repository-governance implementation. This PR must not replace or compete with it.
Outcome
Install the pinned gh-aw runtime and a staged EventRelay-specific canary while repairing the repository's false-green Coverage signal.
This branch currently:
v0.82.14and its setup action;.aw.ymlloop;Verified evidence
598de92d37b78dcc97858b7cd90e08062e14c0fb.action_required; no exact-head CI/coverage/gh-aw result exists yet.continue-on-errorplus|| truecaused the false green.Corrections required before workflow approval
engine: codex; do not claim the gh-aw runtime itself is Jules.workflow_run.branches: [main]filter is insufficient for that canary.Exact-head workflow runs awaiting human approval
Execution receipt
Copilotcopilot/fix-gh-aw-issue/ ci: install pinned gh-aw canary and make coverage authoritative #9212026-07-22T03:56:35Z2026-07-22T04:07:00Z598de92d37b78dcc97858b7cd90e08062e14c0fbNo agent has been disabled. No merge, workflow approval, credential change, production mutation, ruleset weakening, or branch deletion has been performed.