Skip to content

Use runtime ${{ github.action_ref }} for dev-mode "Checkout actions folder" step#20775

Merged
pelikhan merged 11 commits intomainfrom
copilot/update-checkout-actions-folder
Mar 13, 2026
Merged

Use runtime ${{ github.action_ref }} for dev-mode "Checkout actions folder" step#20775
pelikhan merged 11 commits intomainfrom
copilot/update-checkout-actions-folder

Conversation

Copy link
Contributor

Copilot AI commented Mar 13, 2026

In dev mode, the compiler was unconditionally emitting a "Checkout actions folder" step without a ref, or (in intermediate builds) baking in a compile-time commit SHA. Using a compile-time SHA in a dev workflow is misleading — the checkout should always track the ref of the action currently being executed.

Changes

  • compiler_yaml_helpers.go: The dev-mode checkout step now always emits ref: ${{ github.action_ref }}, a GitHub Actions runtime expression that resolves to the ref of the action being executed. Removed the isSHA() helper and gitSHAPattern variable that were part of an earlier approach.

  • maintenance_workflow.go: The maintenance workflow's dev/script-mode "Checkout actions folder" step now also emits ref: ${{ github.action_ref }} instead of calling versionToGitRef(version) (which baked in a compile-time SHA). The generated agentics-maintenance.yml has been regenerated accordingly.

  • compiler_custom_actions_test.go: Updated TestCheckoutActionsFolderDevModeHasRepository to assert the ${{ github.action_ref }} macro is present. Replaced the three separate SHA/tag version tests with a single table-driven test TestCheckoutActionsFolderDevModeAlwaysEmitsCheckout that confirms the checkout step and the runtime macro are always emitted regardless of the compiler version string.

Behaviour summary

Version string Dev checkout emitted? ref value
"dev" ✅ yes ${{ github.action_ref }}
"v1.2.3" ✅ yes ${{ github.action_ref }}
"e284d1e" ✅ yes ${{ github.action_ref }}
"v1.2.3-60-ge284d1e" ✅ yes ${{ github.action_ref }}
Original prompt

Update compiler such that the dev only checkout if the actions folder (checkout actions folder) does NOT emit ref: sha


📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.



✨ PR Review Safe Output Test - Run 23050937333

💥 [THE END] — Illustrated by Smoke Claude ·

Copilot AI and others added 2 commits March 13, 2026 05:54
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
In dev mode, generateCheckoutActionsFolder now returns nil when the
compiler version resolves to a git commit SHA (e.g. from a git-describe
intermediate build like v1.2.3-60-ge284d1e). The checkout step is only
emitted when there is no ref (version == "dev") or the ref is a clean
tag (version == "v1.2.3").

- Add isSHA() helper that matches hex-only strings of 4-40 chars
- Guard dev-mode checkout with !isSHA(ref)
- Update TestCheckoutActionsFolderDevModeWithVersionHasRef to expect nil
- Add TestCheckoutActionsFolderDevModeWithGitDescribeSHAIsSkipped
- Add TestCheckoutActionsFolderDevModeWithTagVersionGeneratesCheckout

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Update compiler to conditionally checkout actions folder Skip dev-mode "Checkout actions folder" step when ref resolves to a SHA Mar 13, 2026
Copilot AI requested a review from pelikhan March 13, 2026 06:06
if c.actionMode.IsDev() {
// Skip the checkout when ref resolves to a commit SHA – pinning to an
// intermediate SHA is not meaningful in a dev workflow.
if c.actionMode.IsDev() && !isSHA(ref) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot remove the isSHA call. You should emit a ref that resolves to the ref of action being executed. NOT the current ref. This should be a github action macro that resolves at runtime.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 2a5c538. The isSHA check is removed. The dev-mode checkout now always emits ref: ${{ github.action_ref }}, which resolves at runtime to the ref of the action being executed.

Instead of baking in a compile-time SHA (or skipping the checkout
entirely), the dev-mode Checkout actions folder step now always emits
`ref: ${{ github.action_ref }}`. This runtime expression resolves to
the ref of the action being executed, keeping the checkout in sync
with whatever version is actually running.

Removes the isSHA() helper and gitSHAPattern variable that were added
in the previous approach.

Updates tests to verify the runtime macro is always present in dev
mode regardless of compiler version string.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title Skip dev-mode "Checkout actions folder" step when ref resolves to a SHA Use runtime ${{ github.action_ref }} for dev-mode "Checkout actions folder" step Mar 13, 2026
Copilot AI requested a review from pelikhan March 13, 2026 06:20
@pelikhan
Copy link
Contributor

@copilot recompile

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 13, 2026

@copilot recompile

Done in 15e16f7 — all 168 workflow lock files recompiled.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copy link
Contributor

@pelikhan pelikhan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot regenerate agentic mainetenanxe file

…entics-maintenance.yml

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Mar 13, 2026

@copilot regenerate agentic mainetenanxe file

Done in 5b46305. The maintenance_workflow.go now also uses ref: ${{ github.action_ref }} instead of baking in a compile-time SHA, and agentics-maintenance.yml has been regenerated accordingly.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -embedcfg /tmp/go-build2573941638/b336/embedcfg -pack (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha folder^{commit} (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/a70c5eada06553e3510ac27f2c3bda9d3705bccb --jq .object.sha (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Copilot AI requested a review from pelikhan March 13, 2026 12:01
@pelikhan pelikhan marked this pull request as ready for review March 13, 2026 12:04
Copilot AI review requested due to automatic review settings March 13, 2026 12:04
@pelikhan pelikhan added smoke and removed smoke labels Mar 13, 2026
- Modified multiple workflow files to change the checkout reference from `${{ github.action_ref }}` to `${{ github.action_ref || github.ref }}`. This ensures that the reference resolves correctly in both workflow_call contexts and other triggering contexts such as schedule, workflow_dispatch, and push.
- Updated tests to reflect the new reference format, ensuring that the dev mode checks for the correct reference usage.
@pelikhan pelikhan added smoke and removed smoke labels Mar 13, 2026
@pelikhan pelikhan added smoke and removed smoke labels Mar 13, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 13, 2026

✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 13, 2026

🎬 THE ENDSmoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

@github-actions
Copy link
Contributor

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

@github-actions
Copy link
Contributor

github-actions bot commented Mar 13, 2026

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

@github-actions
Copy link
Contributor

Agent Container Tool Check

Tool Status Version
bash 5.2.21
sh available
git 2.53.0
jq 1.7
yq 4.52.4
curl 8.5.0
gh 2.87.3
node 20.20.1
python3 3.12.3
go 1.24.13
java 10.0.102
dotnet NOT FOUND

Result: 11/12 tools available ❌

Overall Status: FAILdotnet (.NET runtime) is not installed in the agent container.

🔧 Tool validation by Agent Container Smoke Test ·

@pelikhan pelikhan merged commit f8e4293 into main Mar 13, 2026
50 of 52 checks passed
@pelikhan pelikhan deleted the copilot/update-checkout-actions-folder branch March 13, 2026 12:35
@github-actions
Copy link
Contributor

Smoke Test

  • PR titles: "Fix pagination bug in update-project field fetching (hard limit of 20)", "Move sync_actions instructions to push_tag so they appear before the environment gate"
  • GitHub MCP (2 merged PRs): ✅
  • Serena MCP (activate + >=3 symbols): ✅
  • Playwright (title contains GitHub): ✅
  • Web-fetch (contains GitHub): ✅
  • File write + cat + make build: ✅
  • Overall status: PASS

🔮 The oracle has spoken through Smoke Codex ·

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

@github-actions
Copy link
Contributor

Smoke Test Results - Run §23050937333

Core Tests:
1 GitHub MCP ✅ | 2 GH CLI ✅ | 3 Serena ❌ | 4 Build ✅ | 5 Playwright ✅ | 6 Tavily ✅ | 7 File Write ✅ | 8 Bash ✅ | 9 Discussion ✅ | 10 AW MCP ✅

PR Review Tests (#20775):
11 Update PR ✅ | 12 Review Comments ✅ | 13 Submit Review ✅ | 14 Resolve Thread ⚠️ | 15 Add Reviewer ✅ | 16 Push Branch ❌ | 17 Close PR ⚠️

Overall: PARTIAL (Serena MCP EOF errors, push to branch failed in sandbox)

💥 [THE END] — Illustrated by Smoke Claude ·

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

@github-actions
Copy link
Contributor

Smoke test results for this PR 🤖

Test Result
GitHub MCP
MCP Scripts GH CLI
Serena MCP
Playwright
Web Fetch
File Writing + Bash
Discussion Interaction
Build gh-aw
Discussion Creation
Workflow Dispatch
PR Review

Overall: ⚠️ 11/12 PASS

PR author: @app/copilot-swe-agent | Assignees: @pelikhan, @Copilot

📰 BREAKING: Report filed by Smoke Copilot ·

Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smoke Test Review — PR #20775

Found a failing test and a description mismatch in this PR.

  1. TestCheckoutActionsFolderDevModeHasRepository fails — it still asserts repository: github/gh-aw is in dev-mode output, but the implementation no longer includes it. Verified locally.
  2. The PR description claims dev mode now emits ref: ${{ github.action_ref }}, but neither the implementation nor the tests reflect this — the ref field is simply absent.

Please update the failing test and clarify whether ref: ${{ github.action_ref }} is intended.

📰 BREAKING: Report filed by Smoke Copilot

@@ -312,27 +312,22 @@ func TestCheckoutActionsFolderDevModeHasRepository(t *testing.T) {
if !strings.Contains(combined, "repository: github/gh-aw") {
t.Error("Dev mode Checkout actions folder should include 'repository: github/gh-aw' (fix for #20658)")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test failure detected 🔴

TestCheckoutActionsFolderDevModeHasRepository at line 313 still asserts repository: github/gh-aw is present in the dev-mode checkout output:

if !strings.Contains(combined, "repository: github/gh-aw") {
    t.Error("Dev mode Checkout actions folder should include 'repository: github/gh-aw' ...")
}

But the PR removes repository: github/gh-aw from the dev-mode block in compiler_yaml_helpers.go. Running go test -run TestCheckoutActionsFolderDevModeHasRepository ./pkg/workflow/ confirms this test fails with the current changes. This test needs to be updated to reflect the new intended behavior.

" actions\n",
" persist-credentials: false\n",
)
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description vs implementation mismatch ⚠️

The PR description states:

"The dev-mode checkout step now always emits ref: $\{\{ github.action_ref }}"

But the dev-mode block here emits only sparse-checkout, actions, and persist-credentials: false — no ref: field at all. The $\{\{ github.action_ref }} runtime expression is neither added to the implementation nor verified in any test.

If ref: $\{\{ github.action_ref }} is the intended behavior, it needs to be added here. If the intent is to omit ref: entirely, the PR description should be updated.

@github-actions
Copy link
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants