From dea5302203c8cb7d94d186de0731885392a59364 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 08:31:42 +0000
Subject: [PATCH 1/2] Initial plan


From e554ef2d6dd810de289158f4f906f7329794ccbc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 08:53:18 +0000
Subject: [PATCH 2/2] Fix AR-prone workflow gating for closed PR and sighthound
 flows

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/label-closed-prs.yml              |  4 ++--
 .github/workflows/pr-description-caveman.lock.yml   | 12 +++++-------
 .github/workflows/pr-description-caveman.md         |  2 +-
 .github/workflows/sighthound-security-scan.lock.yml |  9 ++++-----
 .github/workflows/sighthound-security-scan.md       |  3 +--
 5 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/label-closed-prs.yml b/.github/workflows/label-closed-prs.yml
index 46b1f6bdf7b..18a04e9061a 100644
--- a/.github/workflows/label-closed-prs.yml
+++ b/.github/workflows/label-closed-prs.yml
@@ -15,8 +15,8 @@ jobs:
     name: Label PR Closure Reason
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # Only label PRs that were closed WITHOUT merging, and skip Copilot agent branches
-    if: github.event.pull_request.merged == false && !startsWith(github.event.pull_request.head.ref, 'copilot/')
+    # Only label PRs that were closed WITHOUT merging
+    if: github.event.pull_request.merged == false
     steps:
       - name: Determine and apply closure reason label
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
diff --git a/.github/workflows/pr-description-caveman.lock.yml b/.github/workflows/pr-description-caveman.lock.yml
index 1464ffbed00..d01c4c6e0f6 100644
--- a/.github/workflows/pr-description-caveman.lock.yml
+++ b/.github/workflows/pr-description-caveman.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"6bae935057caa20309dd306db3e3d5211b89ee29e61ec580c37b7b099b3b32a8","body_hash":"485de652516c8dab3637169a8592eb1832716e0d0622387fdd8d719f9a472c25","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"58357ffcfff9e41e0d3654f38f9335907eef8807217537841d9fd0bef83d8bc1","body_hash":"485de652516c8dab3637169a8592eb1832716e0d0622387fdd8d719f9a472c25","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.31","digest":"sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.31@sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.31","digest":"sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.31@sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.31","digest":"sha256:7c63bc4e57d6eac1be996bb793a5a2d74d40b15a616003f4b6805a457046c673","pinned_image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.31@sha256:7c63bc4e57d6eac1be996bb793a5a2d74d40b15a616003f4b6805a457046c673"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.31","digest":"sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.31@sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.5.0","digest":"sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4","pinned_image":"ghcr.io/github/github-mcp-server:v1.5.0@sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4"}],"has_pull_request":true}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -72,9 +72,8 @@ jobs:
   activation:
     needs: pre_activation
     if: >
-      needs.pre_activation.outputs.activated == 'true' && ((github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/') &&
-      !startsWith(github.event.pull_request.head.ref, 'copilot/')) && (github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.id == github.repository_id))
+      needs.pre_activation.outputs.activated == 'true' && ((github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/')) &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id))
     runs-on: ubuntu-slim
     permissions:
       actions: read
@@ -1563,9 +1562,8 @@ jobs:
 
   pre_activation:
     if: >
-      (github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/') &&
-      !startsWith(github.event.pull_request.head.ref, 'copilot/')) && (github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.id == github.repository_id)
+      (github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/')) &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id)
     runs-on: ubuntu-slim
     permissions:
       contents: read
diff --git a/.github/workflows/pr-description-caveman.md b/.github/workflows/pr-description-caveman.md
index 3571a1b7a7c..a6135d91899 100644
--- a/.github/workflows/pr-description-caveman.md
+++ b/.github/workflows/pr-description-caveman.md
@@ -5,7 +5,7 @@ description: Rewrites a merged PR description with a structured, considered summ
 on:
   pull_request:
     types: [closed]
-if: github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/') && !startsWith(github.event.pull_request.head.ref, 'copilot/')
+if: github.event.pull_request.merged == true && !startsWith(github.event.pull_request.head.ref, 'signed/jsweep/')
 permissions:
   contents: read
   pull-requests: read
diff --git a/.github/workflows/sighthound-security-scan.lock.yml b/.github/workflows/sighthound-security-scan.lock.yml
index d8802b35d37..4f8cbed804e 100644
--- a/.github/workflows/sighthound-security-scan.lock.yml
+++ b/.github/workflows/sighthound-security-scan.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"d54117eeb4440a460e81885078ef95b5af6eec50d7c9663fdb15f7a210259c89","body_hash":"1eb831486aa8c691072fdb9a6deb2465ab4199b2da98a3d1279462c01f76eea1","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"e5de77297277acb28a1433ca1245eb8f1c702d4d128082b69f432913c9d640f9","body_hash":"1eb831486aa8c691072fdb9a6deb2465ab4199b2da98a3d1279462c01f76eea1","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.70"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0 (source v6)"},{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.31","digest":"sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.31@sha256:84d861cb6da723ac10b7a00dddf778be681b8cd74b2091f18ce1d67fe4b3e7a1"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.31","digest":"sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.31@sha256:80d982fe7925c640d76cbbfbe94081d2d34f7657b7c37494d8d5488f5dae3c63"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.31","digest":"sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.31@sha256:c05a3f086946fab0833e078f46d35571080f187ca72f038958d45aa5cc150494"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.5.0","digest":"sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4","pinned_image":"ghcr.io/github/github-mcp-server:v1.5.0@sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4"}]}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -23,7 +23,7 @@
 #
 # For more information: https://github.github.com/gh-aw/introduction/overview/
 #
-# Daily security scan using Sighthound; runs agent only when actionable findings are detected and opens one issue with the top violations
+# Daily security scan using Sighthound; triages actionable findings and opens one issue with the top violations
 #
 # Secrets used:
 #   - COPILOT_GITHUB_TOKEN
@@ -379,8 +379,7 @@ jobs:
     needs:
       - activation
       - sighthound_scan
-    if: >
-      (needs.sighthound_scan.outputs.actionable_findings_detected == 'true') && (needs.activation.outputs.daily_ai_credits_exceeded != 'true')
+    if: needs.activation.outputs.daily_ai_credits_exceeded != 'true'
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -1363,7 +1362,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           WORKFLOW_NAME: "Sighthound Security Scan"
-          WORKFLOW_DESCRIPTION: "Daily security scan using Sighthound; runs agent only when actionable findings are detected and opens one issue with the top violations"
+          WORKFLOW_DESCRIPTION: "Daily security scan using Sighthound; triages actionable findings and opens one issue with the top violations"
           HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
         with:
           script: |
diff --git a/.github/workflows/sighthound-security-scan.md b/.github/workflows/sighthound-security-scan.md
index fcb9fc96ab8..ab7959ec24f 100644
--- a/.github/workflows/sighthound-security-scan.md
+++ b/.github/workflows/sighthound-security-scan.md
@@ -2,7 +2,7 @@
 private: true
 emoji: "🛡️"
 name: Sighthound Security Scan
-description: Daily security scan using Sighthound; runs agent only when actionable findings are detected and opens one issue with the top violations
+description: Daily security scan using Sighthound; triages actionable findings and opens one issue with the top violations
 on:
   schedule: daily on weekdays
   workflow_dispatch:
@@ -11,7 +11,6 @@ permissions:
   issues: read
   actions: read
 strict: true
-if: needs.sighthound_scan.outputs.actionable_findings_detected == 'true'
 jobs:
   sighthound_scan:
     runs-on: ubuntu-latest
