mirror of https://github.com/github/awesome-copilot.git synced 2026-10-12 14:54:16 +00:00

Files

T

James MontemagnoandCopilot App d6131471b8 Phase 2: submission-gate, risk tiers, and PR status state machine (#4184 ) (#4190 )

* Add submission-gate check, merge-risk tiers, and PR status state machine (#4184)

Phase 2 (enforcement) of github/awesome-copilot#4184:
- submission-gate aggregate required check (reader) with infra vs contribution failure classification
- merge-risk:low/medium/high classification from .github/risk-tiers.yml with tier approval policy
- Submission Gate Writer maintaining state labels and a persistent status comment
- /rerun-checks and /request-review PR commands
- validate-skills and validate-submission-gate workflows, unit tests, and maintainer docs

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fix codespell findings and add spelling to submission gate checks

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Harden submission gate per review feedback

- Publish the submission-gate check from the trusted writer via the Checks API
  and flag any other submission-gate check run as tampering
- Fail closed on truncated file lists, unscannable diffs, permission lookup
  errors, and skipped required checks
- Discard evaluations when the PR head or reviews change mid-run
- Low tier requires a resource owner approval
- Commands must start the comment, matching the workflow filter

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Address #4190 review: command reader/writer, pools, paths, staleness

- Split /rerun-checks and /request-review into a read-only issue_comment
  reader and a workflow_run writer that re-reads the comment, PR, and
  permission before writing.
- Drop the workflow-security pool; agentic workflows and hooks are
  content (medium unless they add scripts or hook commands); the core
  pool is core-maintainers.
- Include each check's workflow file and eng scripts in its paths.
- Discard evaluations when the base branch or risk labels change; run
  the gate on PR edits (retargeting).
- Correct copies of the writer's check that claim success while the
  evaluation fails.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fail closed on lost contributor signal; publish gate check before labels

- A contributor check whose pr-check job succeeded but whose result artifact
  is missing or unreadable is now an infrastructure failure, so a lost HIGH
  signal can't lower the approval tier.
- Publish the submission-gate check right after stale-state revalidation;
  label and comment sync are independent and reported afterwards.
- Revert the self-path added to validate-agentic-workflows-pr.yml's trigger:
  that workflow rejects any .github change. Exempt it in the drift test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fail closed on bad routing config; advisory checks never hold the gate

- loadGateConfig: a missing review-routing.yml still falls back, but a
  file that can't be parsed (or whose pools isn't a mapping) now throws
  instead of silently relaxing approvals.
- Pending required: false checks no longer keep the PR in
  awaiting-automation or the gate check in progress, and the polling loop
  doesn't wait on them. They render as pending (advisory).
- PR commands: 👀 marks a command as claimed; 🚀 is written only after
  the reply is posted and is the only replay guard, so a run that failed
  partway can be retried.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Fix codespell: unparseable -> unparsable

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

2026-10-01 11:39:09 +10:00

maintainers

Phase 2: submission-gate, risk tiers, and PR status state machine (#4184 ) (#4190 )

2026-10-01 11:39:09 +10:00

.gitkeep

Partners (#354 )

2025-10-29 06:07:13 +11:00

README.agents.md

Remove MCP servers column from generated agents README (#4171 )

2026-09-30 11:21:35 +10:00

README.hooks.md

Add attester package-verification instruction and import-check hook

2026-07-22 01:23:34 -04:00

README.instructions.md

Add IntelliJ IDEA guidance for Java and Kotlin (#3213 )

2026-09-17 11:41:34 +10:00

README.plugins.md

Add modernization workflow canvas (#2758 )

2026-09-14 14:29:03 +10:00

README.skills.md

Add microsoft-store-publisher skill (#4180 )

2026-09-30 11:23:21 +10:00

README.workflows.md

Add weekly comment sync workflow

2026-04-15 14:58:57 +02:00

README.workflows.md

⚡ Agentic Workflows

Agentic Workflows are AI-powered repository automations that run coding agents in GitHub Actions. Defined in markdown with natural language instructions, they enable event-triggered and scheduled automation with built-in guardrails and security-first design.

How to Contribute

See CONTRIBUTING.md for guidelines on how to contribute new workflows, improve existing ones, and share your use cases.

How to Use Agentic Workflows

What's Included:

Each workflow is a single .md file with YAML frontmatter and natural language instructions
Workflows are compiled to .lock.yml GitHub Actions files via gh aw compile
Workflows follow the GitHub Agentic Workflows specification

To Install:

Install the gh aw CLI extension: gh extension install github/gh-aw
Copy the workflow .md file to your repository's .github/workflows/ directory
Compile with gh aw compile to generate the .lock.yml file
Commit both the .md and .lock.yml files

To Activate/Use:

Workflows run automatically based on their configured triggers (schedules, events, slash commands)
Use gh aw run <workflow> to trigger a manual run
Monitor runs with gh aw status and gh aw logs

When to Use:

Automate issue triage and labeling
Generate daily status reports
Maintain documentation automatically
Run scheduled code quality checks
Respond to slash commands in issues and PRs
Orchestrate multi-step repository automation

Name	Description	Triggers
Daily Issues Report	Generates a daily summary of open issues and recent activity as a GitHub issue	schedule
OSPO Contributors Report	Monthly contributor activity metrics across an organization's repositories.	schedule, workflow_dispatch
OSPO Organization Health Report	Comprehensive weekly health report for a GitHub organization. Surfaces stale issues/PRs, merge time analysis, contributor leaderboards, and actionable items needing human attention.	schedule, workflow_dispatch
OSPO Stale Repository Report	Identifies inactive repositories in your organization and generates an archival recommendation report.	schedule, workflow_dispatch
OSS Release Compliance Checker	Analyzes a target repository against open source release requirements and posts a detailed compliance report as an issue comment.	issues, workflow_dispatch
Relevance Check	Slash command to evaluate whether an issue or pull request is still relevant to the project	slash_command, roles
Relevance Summary	Manually triggered workflow that summarizes all open issues and PRs with a /relevance-check response into a single issue	workflow_dispatch
Weekly Comment Sync	Weekly workflow that finds stale code comments or README snippets, makes text-only synchronization updates, and opens a draft pull request when changes are needed.	schedule, workflow_dispatch