Skip to content

[Auto Update] Agentic workflows — fix safe-outputs config and apply pending upgrade#19756

Open
Copilot wants to merge 4 commits into
mainfrom
copilot/update-agentic-workflows
Open

[Auto Update] Agentic workflows — fix safe-outputs config and apply pending upgrade#19756
Copilot wants to merge 4 commits into
mainfrom
copilot/update-agentic-workflows

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 18, 2026 •
edited
Loading

The aw-auto-update workflow run (#25949164516) successfully ran gh aw upgrade but failed to push results. Two root causes:

  1. protect_top_level_dot_folders: true (default) + protected-files: fallback-to-issue blocked all .github/ pushes
  2. The app token lacked workflows:write, required by GitHub for pushing .github/workflows/ files

Safe-outputs fix (aw-auto-update.md)

  • Added github-app: config to provide a token with workflows:write
  • Added allow-workflows: true on both create-pull-request and push-to-pull-request-branch
  • Changed protected-files: fallback-to-issue → allowed (this workflow is explicitly designed to manage these files)

One-time upgrade (what the failed run was trying to do)

  • actions/github-script v8 → v9.0.0
  • github/gh-aw-actions/setup v0.68.3 → v0.72.1
  • github/gh-aw/actions/setup v0.67.2 → v0.72.1
  • Updated actions-lock.json with new SHAs + container image pins
  • Recompiled all 7 workflow lock files
  • Updated .github/agents/agentic-workflows.agent.md references to v0.72.1

Prerequisite

Repo needs vars.APP_ID and secrets.APP_PRIVATE_KEY configured with a GitHub App that has workflows:write installed on dotnet/fsharp.

Copilot AI linked an issue May 18, 2026 that may be closed by this pull request
[Auto Update] Agentic workflows #19749
Open
@T-Gro
Update agentic workflows via gh aw upgrade and fix safe-outputs config
c8dd160 
- Updated actions/github-script from v8 to v9
- Updated github/gh-aw-actions/setup from v0.68.3 to v0.72.1
- Updated github/gh-aw/actions/setup from v0.67.2 to v0.72.1
- Updated actions-lock.json with pinned container images
- Recompiled all workflow lock files
- Updated agent file to v0.72.1 references
- Fixed aw-auto-update.md safe-outputs config:
  - Added github-app config for workflows permission
  - Added allow-workflows: true for create-pull-request and push-to-pull-request-branch
  - Changed protected-files from fallback-to-issue to allowed

Co-authored-by: T-Gro <46543583+T-Gro@users.noreply.github.com>
Copilot AI changed the title [WIP] Update agentic workflow infrastructure via gh aw upgrade [Auto Update] Agentic workflows — fix safe-outputs config and apply pending upgrade May 18, 2026
Copilot finished work on behalf of T-Gro May 18, 2026 08:47
Copilot AI requested a review from T-Gro May 18, 2026 08:47
@T-Gro T-Gro marked this pull request as ready for review May 19, 2026 07:56
@T-Gro T-Gro requested a review from a team as a code owner May 19, 2026 07:56
@T-Gro T-Gro added the AI-Auto-Resolve-Conflicts Opt-in: LabelOps merges main into this PR and resolves conflicts every 3h label May 19, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 19, 2026

✅ No release notes required

@github-actions github-actions Bot mentioned this pull request May 19, 2026
Open
@github-actions github-actions Bot added the AI-Tooling-Check-Bypassed Tooling check: non-fork PR, not diff-analyzed label May 19, 2026
@T-Gro
Merge origin/main and fix agent validation
750bbe3 
- Resolve merge conflict in labelops-pr-maintenance.lock.yml
  (keep full container pinning from upgrade, use main's frontmatter_hash)
- Add missing 'name' field to agentic-workflows.agent.md frontmatter
  (fixes 'Validate skills and agents' CI failure)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@T-Gro T-Gro requested a review from abonie May 20, 2026 13:19
@T-Gro T-Gro enabled auto-merge (squash) May 20, 2026 13:19
@github-project-automation github-project-automation Bot moved this from New to In Progress in F# Compiler and Tooling May 21, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 21, 2026

🤖 LabelOps — Conflicts.

Merge conflict detected in .github/workflows/agentic-state-machine.lock.yml. This file is in the protected .github/ directory which I cannot modify. A maintainer will need to resolve this conflict manually.

Generated by LabelOps — PR Maintenance · ● 16.1M · ◷

@github-actions github-actions Bot mentioned this pull request May 23, 2026
Open
T-Gro
T-Gro approved these changes May 25, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@T-Gro T-Gro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. The changes are well-scoped:

  1. safe-outputs fix — Adding \github-app:\ with \workflows:write\ and \�llow-workflows: true\ correctly addresses the push failure. Switching \protected-files: fallback-to-issue\ → \�llowed\ is appropriate here since this workflow is explicitly designed to manage .github/\ files.

  2. Version upgrade — Clean bump from v0.67.x/v0.68.x → v0.72.1 with properly pinned container image digests (sha256) in both the actions-lock.json and all recompiled lock files. The old \�ctions/github-script@v8\ entry is correctly removed.

  3. Agent doc updates — Version URL bumps and the new CLI Commands Reference section are useful additions.

Prerequisite reminder: Repo needs \�ars.APP_ID\ and \secrets.APP_PRIVATE_KEY\ configured before this workflow will function.

@T-Gro T-Gro added the AI-reviewed PR reviewed by AI review council label May 25, 2026
@T-Gro T-Gro self-requested a review May 25, 2026 11:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@abonie abonie abonie approved these changes

@T-Gro T-Gro Awaiting requested review from T-Gro

Assignees

@T-Gro T-Gro

Copilot code review Copilot

Labels

AI-Auto-Resolve-Conflicts Opt-in: LabelOps merges main into this PR and resolves conflicts every 3h AI-reviewed PR reviewed by AI review council AI-Tooling-Check-Bypassed Tooling check: non-fork PR, not diff-analyzed

Projects

F# Compiler and Tooling
Status: In Progress

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Auto Update] Agentic workflows

3 participants

@abonie @T-Gro