Repo Assist: require explicit noop safe output when no action is taken

[Copilot]

The scheduled Repo Assist run completed successfully but produced no safe outputs, triggering a failure issue despite no runtime/job failure. The workflow prompt allowed a “no action” outcome without explicitly requiring a safe output artifact.

• Root cause

  • Repo Assist guidance emphasized restraint and allowed “no action” runs, but did not explicitly require emitting a safe output in that branch.
  • This permitted successful runs to end with empty safe outputs (items: []), which the conclusion stage treats as a failure condition.

• Change

  • Updated .github/workflows/repo-assist.md with a strict safe-output requirement:
    • If the agent determines there is truly nothing useful to do, it must emit exactly one noop safe output with a brief reason.
    • It must not end with empty safe outputs.

• Behavioral impact

  • “No work this run” is now represented as an explicit, machine-readable outcome (noop) instead of an empty output set.
  • Preserves existing task-selection and action behavior; only clarifies terminal behavior for the no-op path.

**Safe output requirement**: Never end with empty safe outputs. If, after completing all required checks, you determine there is truly nothing useful to do this run, you must emit exactly one `noop` safe output with a brief reason (and no other safe outputs).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build3960202725/b510/launcher.test /tmp/go-build3960202725/b510/launcher.test -test.testlogfile=/tmp/go-build3960202725/b510/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true 1.10.2/active_help.go 1.10.2/args.go x_amd64/vet --gdwarf-5 pickfirst/intern-atomic -o x_amd64/vet --de�� g_.a --debug-prefix-m-ifaceassert x_amd64/vet -g" resolver/delegat-atomic -I x_amd64/vet (dns block)
  • Triggering command: /tmp/go-build2572188529/b514/launcher.test /tmp/go-build2572188529/b514/launcher.test -test.testlogfile=/tmp/go-build2572188529/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 0163�� /tmp/go-build935016357/b094/vet.cfg /home/REDACTED/go/pkg/mod/go.opentelemetry.io/otel-ifaceassert 64/pkg/tool/linux_amd64/vet acehttp@v1.43.0/git --local /opt/hostedtoolc-v 64/pkg/tool/linuorigin (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3960202725/b492/config.test /tmp/go-build3960202725/b492/config.test -test.testlogfile=/tmp/go-build3960202725/b492/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true @v1.1.3/cpu/cpu.go 7008033/b151/ x_amd64/vet /tmp/go-build352/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet ternal/engine/wa-unsafeptr=false x86_64-linux-gnu-unreachable=false x_amd64/vet 7008�� CsQlTmGwP -I x_amd64/vet --gdwarf-5 --64 -o x_amd64/vet (dns block)
  • Triggering command: /tmp/go-build2572188529/b496/config.test /tmp/go-build2572188529/b496/config.test -test.testlogfile=/tmp/go-build2572188529/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s 0163�� fy66OxATrrbMgUIjgo1.25.8 .cfg 64/pkg/tool/linu-nolocalimports -c=4 -nolocalimports -importcfg 64/pkg/tool/linuREDACTED 0163�� /tmp/go-build935016357/b094/vet.cfg /home/REDACTED/go/pkg/mod/go.opentelemetry.io/otel-ifaceassert 64/pkg/tool/linux_amd64/vet acehttp@v1.43.0/git --local /opt/hostedtoolc-v 64/pkg/tool/linuorigin (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build3960202725/b510/launcher.test /tmp/go-build3960202725/b510/launcher.test -test.testlogfile=/tmp/go-build3960202725/b510/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true 1.10.2/active_help.go 1.10.2/args.go x_amd64/vet --gdwarf-5 pickfirst/intern-atomic -o x_amd64/vet --de�� g_.a --debug-prefix-m-ifaceassert x_amd64/vet -g" resolver/delegat-atomic -I x_amd64/vet (dns block)
  • Triggering command: /tmp/go-build2572188529/b514/launcher.test /tmp/go-build2572188529/b514/launcher.test -test.testlogfile=/tmp/go-build2572188529/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 0163�� /tmp/go-build935016357/b094/vet.cfg /home/REDACTED/go/pkg/mod/go.opentelemetry.io/otel-ifaceassert 64/pkg/tool/linux_amd64/vet acehttp@v1.43.0/git --local /opt/hostedtoolc-v 64/pkg/tool/linuorigin (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build3960202725/b510/launcher.test /tmp/go-build3960202725/b510/launcher.test -test.testlogfile=/tmp/go-build3960202725/b510/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true 1.10.2/active_help.go 1.10.2/args.go x_amd64/vet --gdwarf-5 pickfirst/intern-atomic -o x_amd64/vet --de�� g_.a --debug-prefix-m-ifaceassert x_amd64/vet -g" resolver/delegat-atomic -I x_amd64/vet (dns block)
  • Triggering command: /tmp/go-build2572188529/b514/launcher.test /tmp/go-build2572188529/b514/launcher.test -test.testlogfile=/tmp/go-build2572188529/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 0163�� /tmp/go-build935016357/b094/vet.cfg /home/REDACTED/go/pkg/mod/go.opentelemetry.io/otel-ifaceassert 64/pkg/tool/linux_amd64/vet acehttp@v1.43.0/git --local /opt/hostedtoolc-v 64/pkg/tool/linuorigin (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3960202725/b519/mcp.test /tmp/go-build3960202725/b519/mcp.test -test.testlogfile=/tmp/go-build3960202725/b519/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true cfg /tmp/go-build3527008033/b151/ x_amd64/vet 7008033/b288/ telabs/wazero/in/usr/bin/runc --64 x_amd64/vet cfg 7008033/b444/_pkg_.a -I x_amd64/vet --gdwarf-5 ntio/asm/cpu -o x_amd64/vet (dns block)
  • Triggering command: /tmp/go-build2572188529/b523/mcp.test /tmp/go-build2572188529/b523/mcp.test -test.testlogfile=/tmp/go-build2572188529/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Updates the Repo Assist workflow guidance to ensure scheduled runs that take no actions still emit a non-empty, machine-readable safe output, preventing “successful but empty output” runs from being treated as failures.

Changes:

• Adds an explicit requirement to emit exactly one noop safe output (with a brief reason) when there is truly nothing to do.
• Fixes formatting/indentation for the “Bias toward action” guideline bullet.

Show a summary per file

File	Description
.github/workflows/repo-assist.md	Adds “never empty safe outputs” guidance and clarifies the no-op terminal behavior via noop.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

This new requirement depends on the noop safe output, but noop is not declared under the workflow’s safe-outputs: config at the top of this file. Even if noop is auto-enabled by the runner, this is internally inconsistent and makes the requirement easy to miss/misinterpret; it may also break if auto-enabling behavior changes. Consider explicitly adding safe-outputs: noop: (optionally with max: 1) and/or a one-line example of the expected output shape (e.g., noop: "<reason>").