Skip to content

XS✔ ◾ Restore unattended CI dependency updates - #886

Open
Muiris Woulfe (muiriswoulfe) wants to merge 9 commits into
mainfrom
test/copilot-org-billing
Open

XS✔ ◾ Restore unattended CI dependency updates#886
Muiris Woulfe (muiriswoulfe) wants to merge 9 commits into
mainfrom
test/copilot-org-billing

Conversation

@muiriswoulfe

@muiriswoulfe Muiris Woulfe (muiriswoulfe) commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Restore unattended CI dependency updates after successful release initiation on main, with a guarded manual retry. Copilot uses the native GITHUB_TOKEN and copilot-requests: write for organization billing, without a personal PAT.
  • Keep the agent's repository access read-only. Publish changes to the existing release PR through a trusted safe-output job and the existing Azure OIDC/Key Vault GitHub App signer.
  • Support dependency-only updates to Copilot and compiler pins. Build recompiles the agentic workflow and rejects stale generated output.
  • Remove native Actions dependency lockfiles, their tooling, validation, and maintenance instructions. Use standard local action references after trusted checkouts.
  • Retain the compiler-generated agentic executable and its action-pin cache. These are separate from native Actions dependency lockfiles.
  • Remove the obsolete AI skill and the release-PR comment requesting its invocation.

Testing

Test Types

  • Unit tests
  • Manual tests

Unit Test Coverage

Earlier restoration validation: npm run test:no-install passed with 904 tests and 100% statement, branch, function, and line coverage. This result predates the subsequent merge from main. Application tests were not rerun for the latest workflow-only removal.

Other Test Details

The live organization-token billing probe passed with Copilot 1.0.103, returning ORG_BILLING_OK without a PAT or interactive sign-in. The temporary probe is not part of this PR.

Latest native-lockfile removal:

  • gh aw compile update-ci-dependencies --validate --no-check-update: passed twice, with zero warnings and identical generated workflow hashes.
  • git diff --check: passed.
  • git check-attr linguist-generated -- .github/workflows/actions.lock .github/workflows/update-ci-dependencies.lock.yml .github/aw/actions-lock.json: passed. The removed native lockfile has no generated attribute; compiler artifacts remain generated.
  • Focused PowerShell assertions: passed. Native lockfile files and integration references are absent, all 12 publication paths match the prose scope, and local signing actions follow trusted checkouts.
  • npx --no-install prettier@3.9.10 --check '.github\workflows\build.yml' '.github\workflows\pr-automation.yml' '.github\workflows\release-initiate.yml' '.github\workflows\release-publish.yml' '.github\workflows\update-ci-dependencies.md' 'docs\dependency-management.md': blocked by NVM trust error NVM4306. No trust settings were changed.

Release-PR publication was not dispatched. The first release run on main must confirm Azure signing, installation-level workflows: write, and safe-output publication. No release or merge was performed.

Screenshots

Not applicable. This changes repository automation only.

@muiriswoulfe
ci: restore unattended dependency updates
c0dece4 
Use native organization-billed Copilot inference after release initiation.
Add a read-only branch probe to check access without merging into main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
@muiriswoulfe
fix(ci): restrict billing probe to no tools
91eb9ca 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
@muiriswoulfe
test(ci): match production Copilot version
22dc445 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
@muiriswoulfe
ci: remove temporary organization billing probe
13c61e5 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
@muiriswoulfe
Muiris Woulfe (muiriswoulfe) requested review from a team and a max review from Copilot October 29, 2026 15:25
@muiriswoulfe
Muiris Woulfe (muiriswoulfe) requested a review from a team as a code owner October 29, 2026 15:25
@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR Metrics

✔ Thanks for keeping your pull request small.
✔ Thanks for adding tests.

Lines
Product Code -
Test Code -
Subtotal -
Ignored Code 2,633
Total 2,633

Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs!

@github-actions github-actions Bot changed the title Restore unattended CI dependency updates XS✔ ◾ Restore unattended CI dependency updates Oct 29, 2026
@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Super-linter summary

Language Validation result
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
JSON_PRETTIER Pass ✅
MARKDOWN Pass ✅
MARKDOWN_PRETTIER Pass ✅
NATURAL_LANGUAGE Pass ✅
POWERSHELL Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Pass ✅
TYPESCRIPT_PRETTIER Pass ✅
XML Pass ✅
YAML Pass ✅
YAML_PRETTIER Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0

Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Dependabot does not exclude generated workflows, so its updates to compiler-managed pins are reverted during recompilation and cause freshness checks to reject the PR.

1 open issue
6 files not reviewed
What changed in this PR

Supports restoring unattended CI dependency updates for PR Metrics, replacing the manual refresh skill with a documented workflow-based process.

Changes:

  • Document release-triggered updates, manual retries, required permissions, and lockfile maintenance.
  • Add the compiler’s action-pin cache and identify generated workflow files.
  • Remove the obsolete manual dependency-refresh skill.
File Description
docs/​dependency-management.md Documents automated refreshes, authentication, and lockfile regeneration.
.github/​aw/​actions-lock.json Records the compiler setup action’s immutable pin.
.gitattributes Marks compiled workflow YAML files as generated.
.agents/​skills/​refresh-ci-dependencies/​SKILL.md Removes the superseded manual refresh skill.

Review effort: Max

Comment thread docs/dependency-management.md Outdated
@muiriswoulfe
fix(dependabot): exclude generated workflows
01a7dcc 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
Copilot AI max review requested due to automatic review settings October 29, 2026 15:58
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Excluded workflow and lockfile changes prevent verification of agent isolation and privileged publication safeguards, while Azure signing and installation-level workflows:write release publication still require human validation.

No open issues 🎉

1 resolved since last review
6 files not reviewed

Review effort: Max

@muiriswoulfe
docs(dependency-management): update dependency management details
416d7ca 
- Added clarification on the verification of the actions lockfile.
- Expanded on the Copilot CLI and agentic compiler updates.
- Improved readability and structure of the document.
Copilot AI max review requested due to automatic review settings October 29, 2026 16:53
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The .gitattributes setting collapses the native dependency lockfile diff by default, making security-relevant changes to transitive action pins easier to miss during review.

1 open issue
6 files not reviewed

Review effort: Max

Comment thread .gitattributes Outdated
Copilot AI max review requested due to automatic review settings October 29, 2026 17:26
@muiriswoulfe
ci: remove native workflow lockfiles
3df3cd0 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bbc1bf98-847f-4a02-9212-a22eaab288a5
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Core security-sensitive workflows are excluded from review, leaving trigger guards, permissions, and privileged publication boundaries unverified and requiring human review and runtime validation.

No open issues 🎉

1 resolved since last review
6 files not reviewed

Review effort: Max

Copilot AI max review requested due to automatic review settings October 29, 2026 17:40
@muiriswoulfe
docs(dependency-management): improve formatting and clarity
78850be 
- Adjust line breaks for better readability
- Ensure consistent presentation of information
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Core workflow sources and the generated executable are excluded from review, leaving security-sensitive permissions, signing boundaries, and unexercised release-PR publication controls requiring human validation.

No open issues 🎉

5 files not reviewed

Review effort: Max

Copilot AI max review requested due to automatic review settings October 29, 2026 17:49
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Excluded core workflows prevent verification of agent isolation and privileged signing/publication controls, and end-to-end release publication remains unvalidated, requiring human review.

No open issues 🎉

5 files not reviewed

Review effort: Max

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@muiriswoulfe Muiris Woulfe (muiriswoulfe)

Copilot code review Copilot

Labels

pr-metrics-tests-sufficient pr-metrics-XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@muiriswoulfe