Convert verbose GitHub tool lists to toolsets in 9 workflows

[Copilot]

Applies the Q workflow optimization from run #19021453233 that failed to push. Converts verbose allowed: tool lists to concise toolsets: [default] configuration across 9 workflows.

Changes

Modified workflows:

• copilot-pr-prompt-analysis.md (6 tools → toolsets)
• dictation-prompt.md (2 tools → toolsets)
• go-logger.md (2 tools → toolsets)
• instructions-janitor.md (5 tools → toolsets)
• poem-bot.md (3 tools → toolsets)
• semantic-function-refactor.md (2 tools → toolsets)
• technical-doc-writer.md (6 tools → toolsets)
• tidy.md (3 tools → toolsets)
• unbloat-docs.md (5 tools → toolsets)

Before:

tools:
  github:
    allowed:
      - search_pull_requests
      - pull_request_read
      - list_pull_requests
      - get_file_contents
      - list_commits
      - get_commit

After:

tools:
  github:
    toolsets: [default]

Impact

• Reduces configuration by ~50 lines across workflows
• Default toolsets (context, repos, issues, pull_requests, users) provide same functionality
• Standardizes pattern with 3 workflows already optimized on Nov 2
• Auto-includes future tools added to default toolset

Validation

All 9 workflows compile successfully (0 errors, 2 expected network firewalling warnings for Claude engine).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[q] Q Workflow Optimization - Convert GitHub tool lists to toolsets</issue_title>
<issue_description># Q Workflow Optimization Report - November 3, 2025

Executive Summary

Optimized 9 agentic workflows by converting verbose GitHub tool allowed: lists to concise toolsets: configuration, reducing code by ~50 lines while improving maintainability.

Triggering Context

• Triggered by: /q command in discussion 🏥 Safe Output Health Report - November 3, 2025 #3015
• Triggered by user: @heiskr
• Analysis date: November 3, 2025

Investigation Summary

Data Sources Analyzed

1. Workflow Status: 66 workflows via gh aw status
2. Compilation Validation: All 7 previously uncompiled workflows now compile successfully
3. Pattern Analysis: Searched for workflows using github: allowed: instead of toolsets:
4. Cache Memory: Reviewed previous Q optimizations from November 1-2

Key Findings from Live Data

1. Compilation Status Improved

All previously uncompiled workflows now compile successfully:

• ✅ copilot-pr-prompt-analysis.md (compiled in this run)
• ✅ dev-hawk.md
• ✅ go-pattern-detector.md
• ✅ lockfile-stats.md
• ✅ security-fix-pr.md
• ✅ smoke-codex.md
• ✅ weekly-issue-summary.md

2. Toolset Conversion Opportunities

Found 9 workflows using verbose allowed: lists that benefit from conversion to toolsets::

1. unbloat-docs.md

   • Before: 5 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 4

2. semantic-function-refactor.md

   • Before: 2 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 1

3. go-logger.md

   • Before: 2 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 1

4. dictation-prompt.md

   • Before: 2 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 1

5. technical-doc-writer.md

   • Before: 6 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 5

6. instructions-janitor.md

   • Before: 5 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 4

7. poem-bot.md

   • Before: 3 individual tools listed (inline array)
   • After: toolsets: [default]
   • Lines saved: 1

8. copilot-pr-prompt-analysis.md

   • Before: 6 individual tools listed
   • After: toolsets: [default]
   • Lines saved: 5

9. tidy.md

   • Before: 3 individual tools listed (inline array)
   • After: toolsets: [default]
   • Lines saved: 1

Changes Made

Modified Workflows (.github/workflows/)

1. copilot-pr-prompt-analysis.md

   • Converted: search_pull_requests, pull_request_read, list_pull_requests, get_file_contents, list_commits, get_commit → toolsets: [default]

2. dictation-prompt.md

   • Converted: get_file_contents, search_code → toolsets: [default]

3. go-logger.md

   • Converted: get_file_contents, search_code → toolsets: [default]

4. instructions-janitor.md

   • Converted: list_commits, get_commit, get_file_contents, search_code, get_latest_release → toolsets: [default]

5. poem-bot.md

   • Converted: get_repository, issue_read, pull_request_read → toolsets: [default]

6. semantic-function-refactor.md

   • Converted: get_file_contents, search_code → toolsets: [default]

7. technical-doc-writer.md

   • Converted: issue_read, get_pull_request, pull_request_read, get_file_contents, list_commits, add_reaction → toolsets: [default]

8. tidy.md

   • Converted: list_pull_requests, pull_request_read, search_pull_requests → toolsets: [default]

9. unbloat-docs.md

   • Converted: get_repository, get_file_contents, list_commits, get_pull_request, search_pull_requests → toolsets: [default]

Default Toolsets Coverage

The [default] toolsets include: context, repos, issues, pull_requests, users

All tools from the converted allowed: lists are covered by these default toolsets, ensuring no functionality is lost.

Benefits Achieved

Code Reduction

• Lines removed: ~50 lines across 9 workflows
• Total lines before: ~70 lines of GitHub tool configuration
• Total lines after: 9 lines of toolset configuration
• Reduction: ~85% decrease in configuration verbosity

Maintainability Improvements

• Single-line configuration: toolsets: [default] instead of multi-line tool lists
• Self-documenting: Clear semantic grouping ("default" conveys standard tool access)
• Reduced duplication: Workflows share a common, well-defined toolset
• Easier auditing: Toolset names are easier to scan than individual tool lists

Future-Proofing

• Automatic tool updates: New tools added to default toolset automatically become available
• Consistent behavior: All workflows using [default] get the same tool access
• **Reduced maintenan...

• Fixes [q] Q Workflow Optimization - Convert GitHub tool lists to toolsets #3018

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR updates the GitHub Agentic Workflows documentation and workflow configurations to transition from granular tool permission lists to the simplified toolsets approach. The changes standardize tool configuration across all workflows by replacing individual allowed arrays with toolsets: [default], which provides access to a curated set of GitHub API tools. The documentation is also updated to reflect new features including firewall support, environment configuration, and additional frontmatter fields.

Key Changes

• Replaced granular github.allowed arrays with toolsets: [default] across all workflow files
• Added documentation for new frontmatter fields (reaction, manual-approval, environment, container, services, description, source, github-token, roles, strict, features)
• Updated network permissions documentation to reflect AWF (Agent Workflow Firewall) support for Copilot engine
• Added search to the list of available GitHub toolsets
• Regenerated .lock.yml files with expanded tool lists based on default toolsets

Reviewed Changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/cli/templates/github-agentic-workflows.instructions.md	Updated documentation to add new frontmatter fields, firewall configuration, engine options, and toolset recommendations
.github/workflows/unbloat-docs.md	Simplified GitHub tools config from 5 specific allowed functions to toolsets: [default]
.github/workflows/unbloat-docs.lock.yml	Regenerated with expanded tool list (54 tools) from default toolset
.github/workflows/tidy.md	Simplified GitHub tools config from 3 specific allowed functions to toolsets: [default]
.github/workflows/tidy.lock.yml	Regenerated to use wildcard tool access (tools: ["*"]) and simplified CLI args
.github/workflows/technical-doc-writer.md	Simplified GitHub tools config from 6 specific allowed functions to toolsets: [default]
.github/workflows/technical-doc-writer.lock.yml	Regenerated to use wildcard tool access and simplified CLI args
.github/workflows/semantic-function-refactor.md	Simplified GitHub tools config from 2 specific allowed functions to toolsets: [default]
.github/workflows/semantic-function-refactor.lock.yml	Regenerated with expanded tool list (54 tools) from default toolset
.github/workflows/poem-bot.md	Simplified GitHub tools config from 3 specific allowed functions to toolsets: [default]
.github/workflows/poem-bot.lock.yml	Regenerated to use wildcard tool access and simplified CLI args
.github/workflows/instructions-janitor.md	Simplified GitHub tools config from 5 specific allowed functions to toolsets: [default]
.github/workflows/instructions-janitor.lock.yml	Regenerated with expanded tool list (54 tools) from default toolset
.github/workflows/go-logger.md	Simplified GitHub tools config from 2 specific allowed functions to toolsets: [default]
.github/workflows/go-logger.lock.yml	Regenerated with expanded tool list (54 tools) from default toolset
.github/workflows/dictation-prompt.md	Simplified GitHub tools config from 2 specific allowed functions to toolsets: [default]
.github/workflows/dictation-prompt.lock.yml	Regenerated to use wildcard tool access in MCP config
.github/workflows/copilot-pr-prompt-analysis.md	Simplified GitHub tools config from 6 specific allowed functions to toolsets: [default]
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Regenerated to use wildcard tool access and simplified CLI args

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.