[Issue Arborist] Issue Arborist Report — 2026-07-12

[github-actions[bot]]

🌳 Issue Arborist Report

Issues analyzed: 54

Parent issues created

None — all identified clusters already had existing parent issues.

Links created (26 total)

Parent	Sub-issue	Reasoning
#1285 Recurring agentic workflow failures	#1478	Dependency Updater rate-limit incident
#1285	#1467	Issue Arborist rate-limit incident
#1285	#1459	Bash Step Hygiene Auditor failure incident
#1285	#1441	Dependency Updater rate-limit incident
#1285	#1435	Test Reducer no-safe-outputs incident
#1285	#1430	Issue Arborist rate-limit incident
#1285	#1412	Dependency Updater rate-limit incident
#1285	#1389	Rust PR Reviewer rate-limit incident
#1285	#1388	Issue Arborist rate-limit incident
#1285	#1373	Dependency Updater rate-limit incident
#1285	#1369	Test Gap Finder failure incident
#1285	#1365	Issue Arborist rate-limit incident
#1283 Upstream deps release-note tracking	#1305	copilot-cli release action items
#1283	#1304	awf release action items
#1283	#1253	mcpg release action items
#1286 Compiler internals improvements	#987	Refactor: split agentic-pipeline shape out of standalone_ir.rs
#1286	#384	Refactor: YAML generation manual string building in compile_gate_step_external
#1286	#1081	feat(ir): add EnvValue::RuntimeExpression variant
#1286	#1375	Reject unwireable cross-job provider-env macros
#1286	#1378	Refactor: unify AzureCLI@2 token-mint steps
#1321 MCPG infrastructure improvements	#1034	MCPG docker invalid reference format bug
#1321	#945	Custom MCP container env passthrough bug
#1321	#254	Surface MCPG backend failures in pipeline logs
#1321	#1452	Make generated SafeOutputs MCP trusted/explicitly allowed
#1428 Safe-output executor E2E	#381	fix: add file staging to upload-workitem-attachment
#1428	#1103	add-pr-comment: render inline threads as suggestions

Suggested (not linked — for maintainer review)

• feat: support reusable cross-repository custom safe-output jobs #1473 (cross-repo custom safe-output jobs) + [agent-issue]: make generated SafeOutputs MCP trusted and explicitly allowed by Copilot CLI #1452 — both touch safe-output security/trust boundary; could form a security-scoped sub-cluster under a new "safe-output security hardening" parent if more issues accumulate.
• feat: built-in PR context precomputation for PR-triggered agents #860 (PR context precomputation), Inject runtime parameter values into the agent prompt via ado-script (sanitization at runtime, not compile time) #432 (runtime param injection), feat: decouple prompt body from compiled pipeline output (runtime-import approach) #237 (runtime-import), feat: align FrontMatter fields with gh-aw schema — run-name, labels, metadata, tracker-id, source, strict #451 (FrontMatter alignment), [agent-issue]: support per-job pool overrides for generated jobs #1464 (per-job pool overrides) — 5 compiler feature enhancements without a parent, but they span different subsystems; consider a "compiler features" epic if more are filed.
• chore(workflows): recompile safe-output fixtures with ado-aw v0.38.0 #1156, chore(workflows): recompile safe-output fixtures with ado-aw v0.37.0 #1041, chore(workflows): recompile safe-output fixtures with ado-aw v0.36.0 #1027 — "recompile fixtures" chores that follow releases; only 3, below the 5+ threshold for a new parent.
• [aw]: Follow-up to #1453: create-pull-request MCP-preflight still fails on shallow/detached-HEAD checkouts in the Agent job #1457 — create-pull-request MCP-preflight shallow/detached-HEAD bug; related to [Parent] MCPG infrastructure and safe-output tooling improvements #1321 (MCPG) but semantically about safe-output execution; ambiguous, left unlinked.

Observations

• The backlog has a healthy parent/child structure from previous arborist runs; most clusters were already covered by existing parents.
• The largest uncategorized cluster (12 incidents) under [Parent] Recurring agentic workflow failure incidents (docs-freshness, dependency-updater rate-limit, test-gap-finder) #1285 now has all recent rate-limit and failure incidents linked, making the recurring-failure epic fully current.
• [Parent] Issue Arborist - Issue Group #1284 ("Issue Arborist - Issue Group") has no children in this run's dataset; it may already have sub-issues from prior runs or be superseded by [Parent] Recurring agentic workflow failure incidents (docs-freshness, dependency-updater rate-limit, test-gap-finder) #1285.
• Security-related issues (shell injection 🔴 Red Team Audit — High: Shell injection via runtimes.lean.toolchain #855, MCP trust [agent-issue]: make generated SafeOutputs MCP trusted and explicitly allowed by Copilot CLI #1452, cross-repo safe-output feat: support reusable cross-repository custom safe-output jobs #1473) are spread across labels; a dedicated security parent could be useful once more accumulate.

Generated by Issue Arborist · 37.1 AIC · ⌖ 6.28 AIC · ⊞ 6K · ◷

• expires on Jul 19, 2026, 8:38 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Issue Arborist.

A newer discussion is available at Discussion #1503.