Cache failed action resolutions per compilation run

[Copilot]

When action resolution fails (e.g., non-existent tag github/gh-aw/actions/setup@v0.45.7), the resolver retries the same failing resolution on subsequent encounters during compilation, making redundant GitHub API calls that will fail identically.

Changes

• ActionResolver: Added failedResolutions map[string]bool to track failures per compilation run
• ResolveSHA: Check failed cache before attempting resolution; mark failures when they occur
• Test: Added TestActionResolverFailedResolutionCache to verify skip behavior

Impact

Eliminates redundant API calls for failed resolutions:

• First attempt: ~45ms (API query + failure)
• Subsequent attempts: ~10µs (immediate skip)

// First attempt
workflow:action_resolver Resolving SHA for action: nonexistent/action@v999.999.999
workflow:action_resolver Failed to resolve... [45ms]
workflow:action_resolver Marked nonexistent/action@v999.999.999 as failed

// Second attempt  
workflow:action_resolver Skipping resolution: already failed in this run [10µs]

The cache is scoped to the compilation run - failures are not persisted across compilations, only preventing duplicate attempts within a single run.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -ifaceassert -nilfunc git rev-�� --show-toplevel -tests om/testorg/testrepo.git (http block)
• https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha atjTay5oJ -tests /home/REDACTED/.dotnet/tools/bash (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v3
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/go-build1001111899/b145/_pkg_.a -trimpath sh -p github.com/cli/grev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.0/xTest User -uns�� 2815-13432/test-1385094301/.github/workflows /tmp/go-build1001111899/b021/vet.cfg k/_temp/ghcca-node/node/bin/bash -c=4 -nolocalimports -importcfg /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha g_.a /tmp/go-build1001111899/b261/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha brave.md /tmp/go-build1001111899/b115/vet.cfg ache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git (http block)
• https://api.github.com/repos/actions/checkout/git/ref/tags/v5
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 1111899/b267/_pkg_.a user.email ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha /tmp/go-build3783098560/b320/_pkg_.a l 0/x64/bin/node -p github.com/githurev-parse -lang=go1.25 0/x64/bin/node -o e: ${{ secrets.TOKEN }} (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha user.name om/owner/repo.git (http block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -c=4 -nolocalimports -importcfg /tmp/go-build3783098560/b334/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/spf13/pflag@v1.0.10/bool.go /home/REDACTED/go/pkg/mod/github.com/spf13/pflag@v1.0.10/bool_func.go (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha v1.0.1/lookpath.-errorsas (http block)
• https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha blog-auditor.md s/bot-detection.md s/brave.md s/breaking-changgit s/changeset.md s/chroma-issue-i--show-toplevel s/ci-coach.md s/ci�� s/claude-code-user-docs-review.md s/cli-consistency-checker.md 7744479/b293/vet.cfg (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -bool -buildtags /home/REDACTED/work/_temp/ghcca-node/node/bin/git -errorsas -ifaceassert -nilfunc git ls-f�� 2815-13432/test-936919776 --others 0/x64/bin/node (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
  • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
  • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 .cfg x_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
  • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 .cfg 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
  • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 .cfg 64/pkg/tool/linu-buildmode=exe (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
  • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 .cfg 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
  • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 .cfg 64/pkg/tool/linux_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
  • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 .cfg 64/pkg/tool/linux_amd64/vet http.https://gitgit (http block)
• https://api.github.com/repos/github/gh-aw/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
  • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ty-test.md --local ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet credential.userngit (http block)
• https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha 1111899/b155/_pk--detach --local .cfg credential.userngit (http block)
  • Triggering command: `/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git iAGGLxn-H attempts

• Addrev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote..*.gh-resolved$ 64/bin/node om/thlib/go-timegit .cfg x_amd64/compile git` (http block)

• https://api.github.com/repos/nonexistent/repo/actions/runs/12345
  • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion http.https://gitgit (http block)
• https://api.github.com/repos/owner/repo/actions/workflows
  • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo x_amd64/vet (http block)
• https://api.github.com/repos/owner/repo/contents/file.md
  • Triggering command: /tmp/go-build1637744479/b368/cli.test /tmp/go-build1637744479/b368/cli.test -test.testlogfile=/tmp/go-build1637744479/b368/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true ader (http block)
• https://api.github.com/repos/test-owner/test-repo/actions/secrets
  • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -c=4 -nolocalimports -importcfg /tmp/go-build3783098560/b333/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/spf13/cobra@v1.10.2/active_help.go /home/REDACTED/go/pkg/mod/github.com/spf13/cobra@v1.10.2/args.go (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login oard.go oard_unix.go x_amd64/compile (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login /auth.go (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login 0/harmonica.go 0/projectile.go x_amd64/compile (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR optimizes action resolution by caching failures per compilation run, preventing redundant GitHub API calls for non-existent actions. When an action fails to resolve (e.g., github/gh-aw/actions/setup@v0.45.7), subsequent attempts to resolve the same action within the compilation run are skipped immediately, improving performance from ~45ms to ~10µs.

Changes:

• Added failedResolutions map to ActionResolver to track failures per compilation run
• Modified ResolveSHA to check the failure cache before attempting resolution and mark failures when they occur
• Added comprehensive test coverage for the failed resolution caching behavior

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/workflow/action_resolver.go	Added failedResolutions map field and logic in ResolveSHA to check/populate the failure cache
pkg/workflow/action_resolver_test.go	Added TestActionResolverFailedResolutionCache to verify skip behavior on subsequent failed resolution attempts

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.