feat: Move APM dependency resolution to activation job via pack/unpack by Copilot · Pull Request #20385 · github/gh-aw

Copilot · 2026-03-10T15:53:43Z

APM dependencies were resolved at agent-job runtime — slow, network-dependent, and non-deterministic across retries. This moves resolution to the activation job (pack) and unpacking to the agent job (restore) via a separate apm artifact.

New compilation output

Activation job — pack step + artifact upload:

- name: Install and pack APM dependencies
  id: apm_pack
  uses: microsoft/apm-action@<sha>
  with:
    dependencies: |
      - microsoft/apm-sample-package
    isolated: 'true'
    pack: 'true'
    archive: 'true'
    target: copilot          # inferred from engine
    working-directory: /tmp/gh-aw/apm-workspace

- name: Upload APM bundle artifact
  uses: actions/upload-artifact@<sha>
  with:
    name: apm
    path: ${{ steps.apm_pack.outputs.bundle-path }}
    retention-days: 1

Agent job — download + restore:

- name: Download APM bundle artifact
  uses: actions/download-artifact@<sha>
  with:
    name: apm
    path: /tmp/gh-aw/apm-bundle

- name: Restore APM dependencies
  uses: microsoft/apm-action@<sha>
  with:
    bundle: /tmp/gh-aw/apm-bundle/*.tar.gz
    isolated: 'true'   # only when frontmatter isolated: true

Changes

APMDependenciesInfo — adds Isolated bool field

extractAPMDependenciesFromFrontmatter — adds object format support alongside existing array format:

dependencies:
  packages:
    - microsoft/apm-sample-package
  isolated: true   # clears .github/ primitive dirs before unpack

apm_dependencies.go — replaces GenerateAPMDependenciesStep with GenerateAPMPackStep and GenerateAPMRestoreStep
WorkflowExecutor interface — adds GetAPMTarget() string method; BaseEngine defaults to "all", CopilotEngine returns "copilot", ClaudeEngine returns "claude"; the APM target is inferred from the engine at compile time rather than via a standalone mapping function
compiler_activation_job.go — emits pack step (using engine.GetAPMTarget()) and separate apm artifact upload after prompt generation
compiler_yaml_main_job.go — replaces old install step with artifact download + restore
frontmatter.md — documents new object format and pack/unpack behavior
smoke-claude.md — adds microsoft/apm-sample-package as an APM dependency to exercise the pack/restore path in the smoke test workflow

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Changeset

Type: patch
Description: Package APM dependencies during activation and restore them via the apm artifact, speeding up agent jobs and making resolution deterministic.

Generated by Changeset Generator for issue #20385 · ◷

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "github.com"

See Network Configuration for more information.

Changeset

Type: patch
Description: Package APM dependencies during activation and restore them via the apm artifact so agent jobs use a deterministic dependency bundle.

Generated by Changeset Generator for issue #20385 · ◷

Warning

⚠️ Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
codeload.github.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "codeload.github.com"
    - "github.com"

See Network Configuration for more information.

Changeset

Type: patch
Description: Package APM dependencies during activation and restore them via the apm artifact for deterministic agent jobs.

Generated by Changeset Generator for issue #20385 · ◷

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "github.com"

See Network Configuration for more information.

✨ PR Review Safe Output Test - Run 22953085519

💥 [THE END] — Illustrated by Smoke Claude · ◷

- Add Isolated field to APMDependenciesInfo struct - Support object format {packages, isolated} in extractAPMDependenciesFromFrontmatter - Replace GenerateAPMDependenciesStep with GenerateAPMPackStep + GenerateAPMRestoreStep - Add EngineToAPMTarget helper (copilot→copilot, claude→claude, other→all) - Emit pack step in activation job with separate 'apm' artifact upload - Emit download + restore steps in agent job - Update tests and documentation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pkg/workflow/apm_dependencies.go

- Add GetAPMTarget() to WorkflowExecutor interface with BaseEngine default "all" - CopilotEngine.GetAPMTarget() returns "copilot" - ClaudeEngine.GetAPMTarget() returns "claude" - Remove free function EngineToAPMTarget - compiler_activation_job uses engine.GetAPMTarget() directly Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-10T18:23:49Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha copilot/move-apm-dependency-resolution^{commit} (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -unreachable=false /tmp/go-build2067647365/b062/vet.cfg 7647365/b342/vet.cfg (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha se 7647365/b048/vet.cfg .cfg (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha se 7647365/b034/vet.cfg .cfg (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha se 7647365/b051/vet.cfg .cfg pull.rebase (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha se 7647365/b053/vet.cfg .cfg (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha se 7647365/b111/vet.cfg .cfg (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha se 7647365/b063/vet.cfg .cfg (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha se 7647365/b055/vet.cfg .cfg (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha k/_temp/runtime-logs/user.env (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

pelikhan · 2026-03-10T18:24:30Z

@copilot add microsoft/compliance-rules package to smoke-claude agentic workflow.

…orkflow Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-10T18:30:40Z

@copilot add microsoft/compliance-rules package to smoke-claude agentic workflow.

Done in dfb7260. Added microsoft/compliance-rules to the dependencies field in smoke-claude.md and recompiled the lock file. The activation job now packs the dependency with target: claude and uploads an apm artifact; the agent job downloads and restores it.

github-actions · 2026-03-10T18:32:45Z

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

github-actions · 2026-03-10T18:32:47Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-03-10T18:32:47Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2026-03-10T18:32:49Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-03-10T18:39:13Z

Smoke Test Results for run §22918207837 — @pelikhan

Test	Status
GitHub MCP	✅
MCP Scripts GH CLI	✅
Serena MCP	❌
Playwright	✅
Web Fetch	✅
File Writing	✅
Bash Tool	✅
Discussion Interaction	✅
Build gh-aw	✅
Discussion Creation	✅
Workflow Dispatch	✅
PR Review	✅

Overall: ❌ FAIL — Serena MCP tools unavailable

📰 BREAKING: Report filed by Smoke Copilot · ◷

github-actions

APM dependency resolution moved to the activation job — solid architectural improvement. Two inline notes left: one on the smoke-claude dependency addition, one on the isolated flag docs. Overall this is a well-structured change.

📰 BREAKING: Report filed by Smoke Copilot

docs/src/content/docs/reference/frontmatter.md

.github/workflows/smoke-claude.md

github-actions · 2026-03-10T18:39:46Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-03-10T18:40:05Z

Commit pushed: e49f180

Generated by Changeset Generator

pelikhan · 2026-03-11T05:33:47Z

@copilot update apm-actions v1.3.1 , recompile

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-03-11T05:41:00Z

@copilot update apm-actions v1.3.1 , recompile

Done in 8e6f753. Updated microsoft/apm-action to v1.3.1 (SHA: 5eac264e08ed8db603fe2c40983794f94cab49d8) and recompiled all 166 workflows.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw nMLAs3sO8HZ3 (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/access_log.go /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/actionlint.go (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)
https://api.github.com/repos/microsoft/apm-action/git/ref/tags/v1.3.1
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

github-actions · 2026-03-11T12:51:37Z

🤖 Smoke test run §22953085519 — PARTIAL (core all pass, 3 skipped)

Core (#1–10): ✅✅✅✅✅✅✅✅✅✅
PR Review (#11–17): ✅✅✅⚠️✅⚠️⚠️

Skipped: #14 (PRRT node IDs), #16 (on main branch), #17 (no safe PR to close)

💥 [THE END] — Illustrated by Smoke Claude · ◷

github-actions · 2026-03-11T17:21:16Z

Hey @Copilot 👋 — thanks for this big PR! The APM pack/unpack work is solid and well-tested, but this PR bundles a couple of unrelated changes that make it harder to review:

failure-issue-repo safe-outputs feature — changes to safe_outputs_config.go, notify_comment.go, imports.go, handle_agent_failure.cjs, and docs (glossary.md / safe-outputs.md) don't relate to APM
dispatch.go refactor — the fileDownloadFn dependency-injection type and remote_workflow_test.go updates are independent of APM
data-ops.md documentation changes — removed content unrelated to APM

Could you split these into separate focused PRs? Something like:

feat: Move APM dependency resolution to activation job via pack/unpack (the core work)
feat: Add failure-issue-repo support to safe-outputs (the safe-outputs piece)

This would make each change much easier to review and merge individually. The core APM work looks great — just needs some untangling! 🙏

Generated by Contribution Check · ◷

…ndency-resolution

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Initial plan * feat: Reimplement APM artifact pack/unpack support from PR #20385 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add changeset [skip-ci] --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Initial plan

37b40da

Copilot AI assigned Copilot and pelikhan Mar 10, 2026

Copilot started work on behalf of pelikhan March 10, 2026 15:53 View session

Copilot AI linked an issue Mar 10, 2026 that may be closed by this pull request

feat: Move APM dependency resolution to activation job via pack/unpack #20380

Closed

11 tasks

Copilot AI changed the title ~~[WIP] Resolve APM dependency in activation job and unpack in agent job~~ feat: Move APM dependency resolution to activation job via pack/unpack Mar 10, 2026

Copilot finished work on behalf of pelikhan March 10, 2026 16:23

pelikhan approved these changes Mar 10, 2026

View reviewed changes

pkg/workflow/apm_dependencies.go Outdated Show resolved Hide resolved

Copilot started work on behalf of pelikhan March 10, 2026 18:12 View session

Copilot finished work on behalf of pelikhan March 10, 2026 18:24

Copilot started work on behalf of pelikhan March 10, 2026 18:24 View session

feat: add microsoft/compliance-rules APM dependency to smoke-claude w…

dfb7260

…orkflow Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan March 10, 2026 18:31

pelikhan added the smoke label Mar 10, 2026

This comment has been minimized.

Sign in to view

github-actions bot mentioned this pull request Mar 10, 2026

Smoke Test: Copilot - 22918207837 #20406

Closed

github-actions bot reviewed Mar 10, 2026

View reviewed changes

docs/src/content/docs/reference/frontmatter.md Show resolved Hide resolved

.github/workflows/smoke-claude.md Outdated Show resolved Hide resolved

Add changeset [skip-ci]

e49f180

Copilot finished work on behalf of pelikhan March 11, 2026 00:50

pelikhan added smoke and removed smoke-copilot labels Mar 11, 2026

github-actions bot added the spam label Mar 11, 2026

github deleted a comment Mar 11, 2026

github-actions bot mentioned this pull request Mar 11, 2026

[aw] No-Op Runs #20284

Open

Copilot started work on behalf of pelikhan March 11, 2026 05:33 View session

chore: upgrade microsoft/apm-action to v1.3.1 and recompile

8e6f753

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan March 11, 2026 05:41

pelikhan added smoke and removed smoke spam labels Mar 11, 2026

pelikhan marked this pull request as ready for review March 11, 2026 07:01

Copilot AI review requested due to automatic review settings March 11, 2026 07:01

Copilot AI reviewed Mar 11, 2026

View reviewed changes

This was referenced Mar 11, 2026

[Daily Report] Daily Status Report — 2026-03-11 #20485

Open

Smoke Test: Claude - 22953085519 #20505

Closed

github-actions bot added the smoke-claude label Mar 11, 2026

This comment has been minimized.

Sign in to view

github-actions bot added the needs-work label Mar 11, 2026

Merge remote-tracking branch 'origin/main' into copilot/move-apm-depe…

2fb74e2

…ndency-resolution

Copilot AI added a commit that referenced this pull request Mar 11, 2026

feat: Reimplement APM artifact pack/unpack support from PR #20385

9410c88

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI mentioned this pull request Mar 11, 2026

feat: Reimplement APM artifact pack/unpack support (#20385) #20564

Merged

pelikhan closed this Mar 11, 2026

Conversation

Copilot AI commented Mar 10, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New compilation output

Changes

Changeset

Changeset

Changeset

Uh oh!

Uh oh!

Copilot AI commented Mar 10, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Mar 10, 2026

Uh oh!

Copilot AI commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

pelikhan commented Mar 11, 2026

Uh oh!

Copilot AI commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 10, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Mar 10, 2026 •

edited

Loading

github-actions bot commented Mar 10, 2026 •

edited

Loading

Copilot AI commented Mar 11, 2026 •

edited

Loading