Add error detection for git tool usage in workflows and fix affected workflows#15749
Merged
Add error detection for git tool usage in workflows and fix affected workflows#15749
Conversation
…sh-to-pull-request-branch Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
pelikhan
reviewed
Feb 14, 2026
| // Wildcard allows all commands | ||
| return true | ||
| } | ||
| if cmd == "git" { |
This was referenced Feb 14, 2026
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot stopped work on behalf of
pelikhan due to an error
February 14, 2026 19:26
Contributor
|
@copilot keep working |
Contributor
|
@copilot keep working |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Completed the implementation. The validation now:
Example error message: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
[WIP] Add error detection for git tool usage in workflows
Add error detection for git tool usage in workflows with wildcard support
Feb 14, 2026
Contributor
|
@copilot this workflow should fail to build https://github.com/github/gh-aw/blob/main/.github/workflows/daily-doc-updater.md |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Implementation complete! All tasks finished: ✅ Validation detects missing git for PR features Ready for review. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
Author
Confirmed! The workflow correctly fails to compile: The workflow has Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot fix the workflows that fail to compile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed all 8 workflows (commit 3aa8e0b): ✅ cloclo.md - Changed to All 154 workflows now compile successfully. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>` (http block)
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>` (http block)
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> k/_temp/ghcca-node/node/bin/git` (http block)
|
…workflows Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
Add error detection for git tool usage in workflows with wildcard support
Add error detection for git tool usage in workflows and fix affected workflows
Feb 14, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds compile-time validation to detect when workflows use create-pull-request or push-to-pull-request-branch safe-output features without explicitly allowing git commands in their bash tool configuration. The validation catches configuration errors early by checking before applyDefaults() modifies the tools configuration. All 8 affected workflows plus 1 shared import have been fixed to comply with the new requirement.
Changes:
- Added git tool validation for PR-related safe-outputs with comprehensive error messages
- Implemented wildcard pattern support ("", "git", "git ", "git:", "git checkout:")
- Fixed 9 workflow files (8 workflows + 1 shared import) to explicitly allow git in bash configuration
- Created extensive unit and integration tests with 100% coverage of validation scenarios
Reviewed changes
Copilot reviewed 40 out of 40 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/tools_validation.go | Added isGitToolAllowed() and validateGitToolForSafeOutputs() functions with wildcard pattern support |
| pkg/workflow/tools_validation_test.go | Comprehensive unit tests covering all bash configuration scenarios and wildcard patterns |
| pkg/workflow/git_tool_validation_integration_test.go | Integration tests verifying end-to-end compilation with various bash configurations |
| pkg/workflow/compiler_orchestrator_workflow.go | Added validation call before applyDefaults() to check user's explicit bash configuration |
| .github/workflows/cloclo.md | Changed bash to true (allows all commands) |
| .github/workflows/daily-doc-updater.md | Added "git" to bash allowed commands list |
| .github/workflows/developer-docs-consolidator.md | Added "git" to bash allowed commands list |
| .github/workflows/go-logger.md | Added "git" to bash allowed commands list |
| .github/workflows/poem-bot.md | Added "git" to bash allowed commands list |
| .github/workflows/slide-deck-maintainer.md | Added "git" to bash allowed commands list |
| .github/workflows/ubuntu-image-analyzer.md | Added "git" to bash allowed commands list |
| .github/workflows/unbloat-docs.md | Added "git" to bash allowed commands list |
| .github/workflows/shared/jqschema.md | Added "git" to bash (fixes all workflows that import this shared file) |
| *.lock.yml files | Updated lock files with new frontmatter hashes and bash tool configurations |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementation Plan: Validate Git Tool for Create/Push PR Operations
Summary
Added validation to detect when workflows use
create-pull-requestorpush-to-pull-request-branchwithout allowing git commands in bash configuration, then fixed all affected workflows to comply with the new requirement.Validation Implementation ✅
New Files:
pkg/workflow/git_tool_validation_integration_test.go- Comprehensive integration testspkg/workflow/tools_validation.go- Added wildcard pattern support and validation logicpkg/workflow/tools_validation_test.go- Comprehensive unit testspkg/workflow/compiler_orchestrator_workflow.go- Added validation callKey Features:
*,git,git *,git:*,git checkout:*Error Message Example:
Workflow Fixes ✅
Fixed 8 workflows and 1 shared import that were missing git in their bash configuration:
true(allows all commands)"git"to bash allowed commands"git"to bash allowed commands"git"to bash allowed commands"git"to bash allowed commands"git"to bash allowed commands"git"to bash allowed commands"git"to bash allowed commands"git"to bash (fixes import-based workflows)All 154 workflows now compile successfully with the new validation.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.
✨ PR Review Safe Output Test - Run 22022790111