From c9fbbde99fdeeff380d5f9030c6fc2ccefc22f27 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 04:02:52 +0000 Subject: [PATCH 1/2] Fix yamllint comments-indentation for fully-commented on: children When every child of an `on:` event key (e.g. `deployment_status:`) is commented out, the trailing comment block sat at the child indent (4) while its parent key was at indent 2 and the following top-level key at column 0, tripping yamllint's comments-indentation rule. dedentTrailingOnCommentBlock now dedents a deep trailing block to column 0 when its nearest real content line is a shallower parent key (no sibling to anchor to), while still preserving nested-event blocks that have a real sibling at their indent. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../frontmatter_on_section_cleanup.go | 33 +++++++++++++++--- .../frontmatter_on_section_cleanup_test.go | 34 +++++++++++++++++++ 2 files changed, 62 insertions(+), 5 deletions(-) diff --git a/pkg/workflow/frontmatter_on_section_cleanup.go b/pkg/workflow/frontmatter_on_section_cleanup.go index 965df2a94bf..bc43b163f61 100644 --- a/pkg/workflow/frontmatter_on_section_cleanup.go +++ b/pkg/workflow/frontmatter_on_section_cleanup.go @@ -745,13 +745,36 @@ func dedentTrailingOnCommentBlock(lines []string) []string { return lines } - // Only dedent comments at the direct `on:` children level (≤2 spaces / 1 tab). - // Comments nested deeper — e.g. `forks:` inside `pull_request:` at 4-space indent — - // are part of a nested event section and must keep their indentation so that the - // visual structure of the `on:` block is preserved. + // Comments at the direct `on:` children level (≤2 spaces / 1 tab) always dedent + // to column 0. Comments nested deeper — e.g. `forks:` inside `pull_request:` at + // 4-space indent — are usually part of a nested event section that still has real + // sibling content at the same indent (a `types:` line next to a commented + // `# forks:`), so they keep their indentation to preserve the visual structure of + // the `on:` block. + // + // The exception is a parent key whose children are *entirely* commented out — e.g. + // a `deployment_status:` whose only descendants are `# state:` / `# - error`. There + // the block's nearest real content line is the shallower parent key, so the comment + // aligns with neither that key nor the column-0 top-level key that follows the `on:` + // section, and yamllint's comments-indentation rule flags it. In that case dedent to + // column 0 (matching the following content) to clear the warning. firstLineIndent := len(lines[start]) - len(strings.TrimLeft(lines[start], " \t")) if firstLineIndent > 2 { - return lines + // Find the nearest preceding real (non-blank) content line — the anchor the + // comment block visually attaches to. + anchor := start - 1 + for anchor >= 0 && strings.TrimSpace(lines[anchor]) == "" { + anchor-- + } + if anchor < 0 { + return lines + } + anchorIndent := len(lines[anchor]) - len(strings.TrimLeft(lines[anchor], " \t")) + // A sibling at the same (or deeper) indent anchors the block — leave it as-is. + // Only a strictly shallower anchor (the parent key) needs dedenting. + if anchorIndent >= firstLineIndent { + return lines + } } for i := start; i <= last; i++ { diff --git a/pkg/workflow/frontmatter_on_section_cleanup_test.go b/pkg/workflow/frontmatter_on_section_cleanup_test.go index afb87174dd5..5c0e739251b 100644 --- a/pkg/workflow/frontmatter_on_section_cleanup_test.go +++ b/pkg/workflow/frontmatter_on_section_cleanup_test.go @@ -119,6 +119,40 @@ func TestDedentTrailingOnCommentBlock(t *testing.T) { "# - admin # Roles processed as role check in pre-activation job", }, }, + { + name: "deeply nested trailing block whose parent has no real children is dedented", + input: []string{ + "on:", + " deployment_status:", + " # state: # State filtering compiled into if condition", + " # - error # State filtering compiled into if condition", + " # - failure # State filtering compiled into if condition", + }, + want: []string{ + "on:", + " deployment_status:", + "# state: # State filtering compiled into if condition", + "# - error # State filtering compiled into if condition", + "# - failure # State filtering compiled into if condition", + }, + }, + { + name: "deeply nested trailing block with a real sibling at its indent is left untouched", + input: []string{ + "on:", + " pull_request:", + " types: [opened]", + " # forks: # Fork filtering applied via job conditions", + " # - octocat # Fork filtering applied via job conditions", + }, + want: []string{ + "on:", + " pull_request:", + " types: [opened]", + " # forks: # Fork filtering applied via job conditions", + " # - octocat # Fork filtering applied via job conditions", + }, + }, { name: "tab-indented trailing comment is dedented", input: []string{ From 63ba69114e506da08cdd13ce0a5116022f7257c8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 04:50:18 +0000 Subject: [PATCH 2/2] Fix test fixtures for pull_request forks-only dedenting to column 0 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .../deployment-incident-monitor.lock.yml | 8 +++---- .../workflows/smoke-call-workflow.lock.yml | 21 ++++++++++++++++--- pkg/workflow/compiler_forks_test.go | 8 +++---- 3 files changed, 26 insertions(+), 11 deletions(-) diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml index 5e58df7f8bc..2942d1de19f 100644 --- a/.github/workflows/deployment-incident-monitor.lock.yml +++ b/.github/workflows/deployment-incident-monitor.lock.yml @@ -62,10 +62,10 @@ name: "Deployment Incident Monitor" on: deployment_status: - # state: # State filtering compiled into if condition - # - error # State filtering compiled into if condition - # - failure # State filtering compiled into if condition - # skip-if-match: is:issue is:open label:incident label:deployment-failure # Skip-if-match processed as search check in pre-activation job +# state: # State filtering compiled into if condition +# - error # State filtering compiled into if condition +# - failure # State filtering compiled into if condition +# skip-if-match: is:issue is:open label:incident label:deployment-failure # Skip-if-match processed as search check in pre-activation job permissions: {} diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml index 15a3ed21b8c..eacad788ec7 100644 --- a/.github/workflows/smoke-call-workflow.lock.yml +++ b/.github/workflows/smoke-call-workflow.lock.yml @@ -619,6 +619,11 @@ jobs: "inputSchema": { "additionalProperties": false, "properties": { + "aw_context": { + "default": "", + "description": "Agent caller context (used internally by Agentic Workflows).", + "type": "string" + }, "payload": { "description": "Input parameter 'payload' for workflow smoke-workflow-call", "type": "string" @@ -1104,15 +1109,25 @@ jobs: needs: safe_outputs if: needs.safe_outputs.outputs.call_workflow_name == 'smoke-workflow-call' # Imported from called workflow "smoke-workflow-call" because GitHub requires the caller job to grant permissions requested by reusable workflow jobs. - # Review the called workflow's frontmatter permissions in ./.github/workflows/smoke-workflow-call.md. + # Review the called workflow's job-level permissions in ./.github/workflows/smoke-workflow-call.lock.yml. permissions: + actions: read contents: read - pull-requests: read + issues: write + pull-requests: write uses: ./.github/workflows/smoke-workflow-call.lock.yml with: + aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }} payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }} task-description: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload)['task-description'] }} - secrets: inherit + secrets: + COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} + GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} + GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} + GH_AW_OTEL_GRAFANA_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }} + GH_AW_OTEL_GRAFANA_ENDPOINT: ${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }} + GH_AW_OTEL_SENTRY_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }} + GH_AW_OTEL_SENTRY_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }} conclusion: needs: diff --git a/pkg/workflow/compiler_forks_test.go b/pkg/workflow/compiler_forks_test.go index 176436c2f89..2a99dbd14ca 100644 --- a/pkg/workflow/compiler_forks_test.go +++ b/pkg/workflow/compiler_forks_test.go @@ -387,8 +387,8 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: # Fork filtering applied via job conditions - # - specific/repo # Fork filtering applied via job conditions`, +# forks: # Fork filtering applied via job conditions +# - specific/repo # Fork filtering applied via job conditions`, description: "Should comment out forks array even when it's the only field", }, { @@ -409,7 +409,7 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: specific/repo # Fork filtering applied via job conditions`, +# forks: specific/repo # Fork filtering applied via job conditions`, description: "Should comment out forks single string", }, { @@ -430,7 +430,7 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: "*" # Fork filtering applied via job conditions`, +# forks: "*" # Fork filtering applied via job conditions`, description: "Should comment out forks wildcard string", }, }