diff --git a/.github/workflows/check-requirements.lock.yml b/.github/workflows/check-requirements.lock.yml
index a80997fa24225..b932dc189912f 100644
--- a/.github/workflows/check-requirements.lock.yml
+++ b/.github/workflows/check-requirements.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"75b8b624ba0c144fb4b28cba143d16a47c30de8afae568fa3256c6febe01a68a","compiler_version":"v0.74.4","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"e4fcdd04986da27ef3059faa0cea3d64bb879fe12085ebfdec0041bbc31ec181","compiler_version":"v0.74.4","strict":true,"agent_id":"copilot"}
# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"d3abfe96a194bce3a523ed2093ddedd5704cdf62","version":"v0.74.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.46"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.46"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.46"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.9","digest":"sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.9@sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]}
# ___ _ _
# / _ \ | | (_)
@@ -59,15 +59,13 @@ permissions: {}
concurrency:
cancel-in-progress: true
- group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }}
+ group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
run-name: "Check requirements (AW)"
jobs:
activation:
- needs:
- - extract_pr_number
- - pre_activation
+ needs: pre_activation
# zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation
if: >
(needs.pre_activation.outputs.activated == 'true') && (github.event_name != 'workflow_run' || github.event.workflow_run.repository.id == github.repository_id &&
@@ -191,20 +189,20 @@ jobs:
run: |
bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
{
- cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF'
+ cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF'
- GH_AW_PROMPT_198418d99edc7d5b_EOF
+ GH_AW_PROMPT_2fc32253e89940f3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
- cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF'
+ cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF'
Tools: add_comment, missing_tool, missing_data, noop
- GH_AW_PROMPT_198418d99edc7d5b_EOF
+ GH_AW_PROMPT_2fc32253e89940f3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
- cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF'
+ cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF'
The following GitHub context information is available for this workflow:
{{#if github.actor}}
@@ -233,12 +231,12 @@ jobs:
{{/if}}
- GH_AW_PROMPT_198418d99edc7d5b_EOF
+ GH_AW_PROMPT_2fc32253e89940f3_EOF
cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
- cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF'
+ cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF'
{{#runtime-import .github/workflows/check-requirements.md}}
- GH_AW_PROMPT_198418d99edc7d5b_EOF
+ GH_AW_PROMPT_2fc32253e89940f3_EOF
} > "$GH_AW_PROMPT"
- name: Interpolate variables and render templates
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -323,7 +321,6 @@ jobs:
permissions:
actions: read
contents: read
- issues: read
pull-requests: read
concurrency:
group: "gh-aw-copilot-${{ github.workflow }}"
@@ -453,9 +450,9 @@ jobs:
mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
mkdir -p /tmp/gh-aw/safeoutputs
mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
- cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_627e06df80c4e5ad_EOF'
+ cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_eaae5443153d0b45_EOF'
{"add_comment":{"max":1,"target":"${{ needs.extract_pr_number.outputs.pr_number }}"},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
- GH_AW_SAFE_OUTPUTS_CONFIG_627e06df80c4e5ad_EOF
+ GH_AW_SAFE_OUTPUTS_CONFIG_eaae5443153d0b45_EOF
- name: Generate Safe Outputs Tools
env:
GH_AW_TOOLS_META_JSON: |
@@ -647,7 +644,7 @@ jobs:
mkdir -p /home/runner/.copilot
GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
- cat << GH_AW_MCP_CONFIG_175174907e5a28b4_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+ cat << GH_AW_MCP_CONFIG_d99df59573a98681_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
{
"mcpServers": {
"github": {
@@ -657,7 +654,7 @@ jobs:
"GITHUB_HOST": "\${GITHUB_SERVER_URL}",
"GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
"GITHUB_READ_ONLY": "1",
- "GITHUB_TOOLSETS": "context,repos,issues,pull_requests,actions"
+ "GITHUB_TOOLSETS": "repos,pull_requests"
},
"guard-policies": {
"allow-only": {
@@ -691,7 +688,7 @@ jobs:
"payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
}
}
- GH_AW_MCP_CONFIG_175174907e5a28b4_EOF
+ GH_AW_MCP_CONFIG_d99df59573a98681_EOF
- name: Mount MCP servers as CLIs
id: mount-mcp-clis
continue-on-error: true
@@ -1284,6 +1281,7 @@ jobs:
}
extract_pr_number:
+ needs: activation
if: github.event.workflow_run.conclusion == 'success'
runs-on: ubuntu-latest
permissions:
diff --git a/.github/workflows/check-requirements.md b/.github/workflows/check-requirements.md
index 3174d7ecf6da0..1e96cdede0aa1 100644
--- a/.github/workflows/check-requirements.md
+++ b/.github/workflows/check-requirements.md
@@ -6,7 +6,6 @@ on:
permissions:
contents: read
actions: read
- issues: read
pull-requests: read
network:
allowed:
@@ -14,7 +13,7 @@ network:
tools:
web-fetch: {}
github:
- toolsets: [default, actions]
+ toolsets: [repos, pull_requests]
min-integrity: unapproved
safe-outputs:
add-comment:
@@ -44,7 +43,7 @@ jobs:
PR=$(jq -r '.pr_number' /tmp/deterministic/results.json)
echo "pr_number=${PR}" >> "${GITHUB_OUTPUT}"
concurrency:
- group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }}
+ group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
cancel-in-progress: true
steps:
- name: Download deterministic-results artifact
@@ -83,296 +82,181 @@ description: >
# Check requirements (AW)
-You are a code review assistant for the Home Assistant project. The
-deterministic stage has already evaluated every check it can on its own
-and produced an artifact containing the PR number, per-package check
-results, and a pre-rendered comment with placeholders. **Your only job is
-to read that artifact, resolve any `needs_agent` checks, and post the
-final comment.**
-
-## Step 1 — Read the deterministic-stage artifact
-
-The deterministic stage uploaded its results to the runner at
-`/tmp/gh-aw/deterministic/results.json`.
-
-The JSON has this shape:
-
-- `pr_number` — the PR being checked. The `add_comment` safe-output is
- already targeted at this PR (a pre-job extracts `pr_number` from the
- artifact and the workflow wires it into the safe-output config via
- `needs.extract_pr_number.outputs.pr_number`), so **you do not need to
- set `item_number` yourself** — just emit `add_comment` with the
- rendered body.
-- `needs_agent` — `true` iff any package's check needs resolution.
-- `packages[]` — one entry per changed package. Each entry has:
- - `name`, `old_version` (`null` for a newly added package; otherwise the
- previous pin), `new_version`, `repo_url`, `publisher_kind`.
- - `checks` — a dict keyed by **check kind** (string). Each value has a
- `status` (`pass`, `warn`, `fail`, or `needs_agent`) and `details`.
-- `rendered_comment` — the final PR comment body, already rendered. For
- every check whose status is `needs_agent` it contains two placeholders
- you must replace:
- - `{{CHECK_CELL::}}` — one cell of the summary
- table. Replace with exactly one of `✅`, `⚠️`, `❌`.
- - `{{CHECK_DETAIL::}}` — the body of one bullet
- in the package's `` block. Replace with
- ` ` (the bullet's leading
- `- **