You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Drops the bots: ["copilot[bot]"] trigger from rust-pr-reviewer, scout-command, issue-plan-maker, and rust-review-command, then recompiles all agentic workflows.
Source .md edits: removed the bots: block under on: in the four workflows above.
Recompile: ran gh aw compile; all 9 workflow lock files regenerated (0 errors, 0 warnings). The unrelated lock-file churn is from the locally installed gh aw version refreshing pinned actions/manifests.
Summary: No Rust source changes — this PR only modifies workflow .md definitions and their compiled .lock.yml files. The intent (removing bots: triggers) is correct, but there are concerns about the recompile.
Findings
🔒 Security Concerns
All recompiled .lock.yml files — The gh-aw-actions/setup action is now referenced as github/gh-aw-actions/setup@v0.68.1 (a mutable tag), replacing the previous @ba90f2186d7ad780ec640f364005fa24e797b360 # v0.68.3 (immutable SHA). Tags can be force-pushed to point to arbitrary commits. This is a supply chain security regression affecting all 9 recompiled workflows. The previous SHA-pinned reference was the secure form.
⚠️ Suggestions
Scope / version churn — The PR description acknowledges that 5 unrelated workflows (cyclomatic-complexity-reducer, doc-freshness-check, red-team-security, test-gap-finder, update-awf-version) got recompiled with the locally-installed compiler v0.68.1, downgrading them from v0.68.3. This rolls back those workflows from AWF v0.25.20 → v0.25.18 and from upload-artifact@v7.0.1 → v7. Ideally the recompile would use the same compiler version that last generated those files, or at minimum the changes to unrelated workflows should be reviewed as a separate concern.
issue-plan-maker.lock.yml — The activation.if condition was simplified correctly when bots: was removed (the extra conjunctive || (!(github.event_name == 'issues')) && (!(github.event_name == 'issue_comment')) clause is gone). This looks intentional and correct.
✅ What Looks Good
The four targeted .md source edits are minimal and correct — only the bots: block is removed, no other front matter is touched.
The compiled lock files correctly no longer include the # bots: / # - copilot[bot] commented-out trigger lines.
No Rust source files were touched; no correctness or safety issues in the compiler itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drops the
bots: ["copilot[bot]"]trigger fromrust-pr-reviewer,scout-command,issue-plan-maker, andrust-review-command, then recompiles all agentic workflows..mdedits: removed thebots:block underon:in the four workflows above.gh aw compile; all 9 workflow lock files regenerated (0 errors, 0 warnings). The unrelated lock-file churn is from the locally installedgh awversion refreshing pinned actions/manifests.Test plan
gh aw compile— 9/9 workflows compiled cleanly.