fix(cgo): remove workflow .md paths from CGO PR trigger; clarify CI action_required vs agentic AR - #47989
Merged
Merged
Conversation
…ction_required vs agentic AR - cgo.yml: remove `.github/workflows/**/*.md` from pull_request path filter. This wildcard caused CGO to fire on every agentic workflow editing PR; those Copilot-bot runs consistently got action_required (GitHub approval gate) with 0 jobs executing. The push trigger never included this path, so push/PR paths are now consistent. Workflow markdown compilation is still validated on push to main via ci.yml. - agent-performance-analyzer.md: add CI vs. agentic workflow distinction in both prompt variants. Instructs the analyzer to track CI-workflow action_required runs separately as "CI approval-pending" rather than counting them as agentic activation-refused (AR). Recommends approving the Copilot-bot at the org level, not treating them as agent failures. Closes #47812 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Investigate CWI 100% activation-refused regression
fix(cgo): remove workflow .md paths from CGO PR trigger; clarify CI action_required vs agentic AR
Jul 25, 2026
pelikhan
marked this pull request as ready for review
July 25, 2026 12:37
Contributor
There was a problem hiding this comment.
Pull request overview
Clarifies CI approval gates in performance analysis and prevents workflow Markdown changes from unnecessarily triggering CGO.
Changes:
- Aligns CGO pull-request and push path filters.
- Distinguishes CI approval-pending runs from agentic activation refusals.
- Regenerates workflow metadata.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/cgo.yml |
Removes workflow Markdown from CGO PR triggers. |
.github/workflows/agent-performance-analyzer.md |
Adds CI approval-gate guidance. |
.github/workflows/agent-performance-analyzer.lock.yml |
Updates the generated body hash. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/agent-performance-analyzer.md:407
- This unconditional instruction can misdiagnose an
action_requiredrun from a non-Copilot contributor and recommend changing a setting for the wrong actor. Moreover, the Copilot coding-agent workflow approval setting is repository-level, not organization-level. Gate the Copilot recommendation on the run actor/event and point to repository settings.
- **CI vs. agentic distinction:** Workflows `CWI`, `CGO`, `CI`, `CJS`, and `CPI` are plain CI workflows, not agentic workflows. An `action_required` conclusion on a CI workflow means GitHub is waiting for a maintainer to approve a pull-request workflow run (a GitHub Actions permission gate). Do **not** count CI-workflow `action_required` as agentic activation-refused (AR). Track these separately as "CI approval-pending" and recommend approving the Copilot-bot's workflow runs at the org level rather than treating them as agent failures.
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Medium
| Track regression signals (quality drop, PR rejection increase, runtime regression). | ||
| Treat `copilot-swe-agent` as a built-in team member in attribution/engagement filters (internal actor, not external community traffic). | ||
|
|
||
| **CI vs. agentic workflow distinction:** Workflows such as `CWI`, `CGO`, `CI`, `CJS`, and `CPI` are plain CI workflows — not agentic workflows. An `action_required` conclusion on a CI workflow means GitHub is waiting for a maintainer to approve a pull-request workflow run (a GitHub Actions permission gate), **not** an agentic activation-refused. Do not count CI-workflow `action_required` runs as agentic AR. Report them separately under "CI approval-pending" and note that the fix is to approve the Copilot-bot's workflow runs at the org level or in the PR, not an agent-side change. |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The agent performance report for July 24 showed CGO at 100% "activation-refused" (AR) and CWI at 100% AR. Both are CI workflows, not agentic — their
action_requiredruns mean GitHub is holding workflow jobs for maintainer approval (common for Copilot-bot PRs), not that an agentic pre-execution policy check failed.Root cause
cgo.ymlhad.github/workflows/**/*.mdin itspull_requestpath filter. In a repo where agents frequently create workflow-editing PRs, this caused CGO to fire on nearly every Copilot PR. Those runs gotaction_required(0 jobs executed) because GitHub requires per-PR approval for the Copilot bot. The push trigger never had this path — the asymmetry was unintentional.The July 8 → July 24 regression is a sampling artifact: the performance analyzer's 100-run window on Jul 24 happened to land entirely on unapproved Copilot PR runs.
Changes
cgo.yml— removed.github/workflows/**/*.mdfrompull_requestpaths, aligning it with thepushtrigger. Workflow markdown compilation is still validated on push tomainviaci.yml.agent-performance-analyzer.md— added a CI-vs-agentic distinction in both prompt variants:action_requiredonCWI,CGO,CI,CJS,CPIis a GitHub Actions approval gate, not agentic AR. Instructs the analyzer to report these as "CI approval-pending" and recommend approving the Copilot bot at the org level.Residual
CWI's
action_requiredstems from**/*.goPR runs from the Copilot bot — same approval mechanism. The permanent fix is an org-level setting to auto-approve the Copilot bot's workflow runs.