[Alexander Holstrup (aholstrup1)]

❔What, Why & How

Older AL-Go updaters and newly created repositories copy review workflows directly from the templates, bypassing the current updater's opt-in exclusions. Automatic triggers in those raw files therefore activate workflows before review is enabled.

Both PTE and AppSource templates now ship with only workflow_dispatch. The intake job requires a pull_request event; runner preparation requires a successful workflow_run event. Manual dispatch skips the entry jobs and their dependent jobs.

When CodeReviewAgent.enabled is true, Update AL-Go System Files adds the intake pull_request and runner workflow_run triggers using the existing YAML helper. Original event types, branch defaults/patterns, permissions, concurrency, and security gates are preserved. Disabled/missing settings still exclude or remove both files. Manual triggers remain available but do not perform reviews.

Validation:

• Invoke-Pester -Path @('.\Tests\CheckForUpdates.Action.Test.ps1', '.\Tests\WorkflowSanitation\WorkflowFileContent.Test.ps1') -PassThru -Output None: 141 passed on PowerShell 7 and 141 passed on Windows PowerShell 5.1, using Pester 5.7.1.
• Local historical fixture using actual v8.2 (d5c257be) file-selection/generation functions and YAML class: 8 passed. Confirms inert templates survive the old updater and reproduces automatic triggers with the pre-change templates. Settings/logging were mocked; this fixture is not committed and does not exercise live upgrade orchestration.
• Parsed eight raw/generated YAML documents; changed PowerShell files passed parsing and ScriptAnalyzer error checks. No live workflows or paid review inference were run.

Related to issue: N/A

✅ Checklist

• Add tests (E2E, unit tests)
• Update RELEASENOTES.md
• Update documentation (e.g. for new settings or scenarios)
• Add telemetry

Release notes and Scenarios/settings.md are intentionally unchanged as requested. The review scenario and settings schema are updated. Telemetry is not applicable.

[Copilot]

🟡 Changes recommended

Manual intake dispatches after opt-in can trigger runner preparation and fail because no metadata artifact was uploaded.

1 open issue

• Guard workflow_run handling to pull_request events · New

What changed in this PR

Makes Copilot review workflows inert by default, with automatic triggers added only through the AL-Go updater after opt-in.

Changes:

• Makes both templates manual-only and adds event guards.
• Generates automatic triggers when CodeReviewAgent.enabled is true.
• Adds regression coverage and updates setup documentation and schema metadata.

File	Description
Tests/​WorkflowSanitation/​WorkflowFileContent.Test.ps1	Checks inert templates and job guards.
Tests/​CheckForUpdates.Action.Test.ps1	Tests opt-in trigger generation and file selection.
Templates/​Per Tenant Extension/​.github/​workflows/​CopilotPRReviewRunner.yaml	Makes runner manual-only and guards preparation.
Templates/​Per Tenant Extension/​.github/​workflows/​CopilotPRReview.yaml	Makes intake manual-only and guards execution.
Templates/​AppSource App/​.github/​workflows/​CopilotPRReviewRunner.yaml	Applies matching runner changes.
Templates/​AppSource App/​.github/​workflows/​CopilotPRReview.yaml	Applies matching intake changes.
Scenarios/​Agents/​CopilotCodeReview.md	Explains enabling and disabling reviews.
Actions/​CheckForUpdates/​CheckForUpdates.HelperFunctions.ps1	Adds automatic triggers only after opt-in.
Actions/​.Modules/​settings.schema.json	Documents the disabled default and activation behavior.

_{Review effort: Balanced}