Add safe coverage artifact upload guidance by Copilot · Pull Request #54875 · github/gh-aw

Copilot · 2026-08-22T17:33:06Z

Coverage workflows lacked a safe-output path for publishing reports generated when no reusable CI artifact exists.

Safe output
- Enable one upload-artifact operation.
- Restrict uploads to coverage/**.
Fallback coverage
- Stage generated reports in the safe-output artifact directory.
- Upload them as coverage-report.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 8.29 AIC · ⊞ 9.5K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 8.21 AIC · ⊞ 9.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-22T17:36:03Z

@copilot this safe output should use this action and introduce a completely new safe output "upload-code-coverage"

https://github.com/actions/upload-code-coverage

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-22T18:28:11Z

@copilot this safe output should use this action and introduce a completely new safe output "upload-code-coverage"

https://github.com/actions/upload-code-coverage

Implemented the new upload-code-coverage safe output backed by actions/upload-code-coverage in ef8954d.

Copilot

Pull request overview

Adds a safe-output pipeline for staging Cobertura reports and publishing them through GitHub’s code coverage API.

Changes:

Adds upload-code-coverage configuration, validation, handlers, and jobs.
Adds code-quality permissions and action pins.
Updates coverage guidance, schemas, types, and tests.

Show a summary per file

File	Description
`pkg/workflow/safe_outputs_validation_config.go`	Validates coverage metadata.
`pkg/workflow/safe_outputs_tools_computation.go`	Enables the coverage tool.
`pkg/workflow/safe_outputs_state.go`	Tracks coverage output state.
`pkg/workflow/safe_outputs_max_validation.go`	Validates upload limits.
`pkg/workflow/safe_outputs_handler_registry.go`	Registers handler configuration.
`pkg/workflow/safe_outputs_config_types.go`	Defines coverage configuration.
`pkg/workflow/safe_outputs_config_extraction.go`	Parses coverage configuration.
`pkg/workflow/safe_output_handlers.go`	Registers the safe-output descriptor.
`pkg/workflow/publish_code_coverage.go`	Builds staging and upload jobs.
`pkg/workflow/publish_code_coverage_test.go`	Tests parsing and job generation.
`pkg/workflow/permissions.go`	Adds `code-quality` scope.
`pkg/workflow/permissions_operations_test.go`	Updates permission tests.
`pkg/workflow/permissions_factory.go`	Defines upload-job permissions.
`pkg/workflow/mcp_setup_safe_outputs.go`	Creates the staging directory.
`pkg/workflow/js/safe_outputs_tools.json`	Adds the generated tool schema.
`pkg/workflow/frontmatter_types.go`	Models `code-quality`.
`pkg/workflow/frontmatter_serialization.go`	Serializes the permission.
`pkg/workflow/frontmatter_parsing.go`	Parses the permission.
`pkg/workflow/data/action_pins.json`	Pins the coverage action.
`pkg/workflow/dangerous_permissions_validation_test.go`	Updates write-scope count.
`pkg/workflow/compiler_yaml_post_agent.go`	Uploads staged coverage.
`pkg/workflow/compiler_safe_outputs_job.go`	Exposes coverage outputs.
`pkg/workflow/compiler_safe_output_jobs.go`	Adds the dedicated upload job.
`pkg/parser/schemas/main_workflow_schema.json`	Documents and validates configuration.
`pkg/parser/schema_errors.go`	Lists the new permission scope.
`pkg/constants/job_constants.go`	Defines the upload job name.
`pkg/cli/lint_command.go`	Suppresses pending actionlint support.
`pkg/actionpins/data/action_pins.json`	Adds the canonical action pin.
`docs/public/editor/autocomplete-data.json`	Adds editor permission completion.
`actions/setup/js/upload_code_coverage.test.cjs`	Tests the handler factory.
`actions/setup/js/upload_code_coverage.cjs`	Records coverage metadata.
`actions/setup/js/types/safe-outputs.d.ts`	Types coverage messages.
`actions/setup/js/types/safe-outputs-config.d.ts`	Types coverage configuration.
`actions/setup/js/safe_outputs_tools.json`	Exposes the setup-action tool schema.
`actions/setup/js/safe_outputs_tools_loader.cjs`	Attaches the MCP handler.
`actions/setup/js/safe_outputs_handlers.test.cjs`	Tests staging and path safety.
`actions/setup/js/safe_outputs_handlers.cjs`	Stages requested report files.
`actions/setup/js/safe_output_handler_manager.cjs`	Routes and reports coverage handling.
`.github/aw/test-coverage.md`	Updates fallback coverage guidance.
`.github/aw/actions-lock.json`	Locks the coverage action version.

Review details

Suppressed comments (1)

.github/aw/test-coverage.md:54

Use the actual command name gocover-cobertura, consistent with the Go example below; go-cobertura would send agents looking for the wrong tool.

- convert the freshly generated coverage report to Cobertura XML format (e.g. `coverage.py xml`, `go-cobertura`, or a JaCoCo/Istanbul Cobertura reporter), stage it under `$RUNNER_TEMP/gh-aw/safeoutputs/upload-code-coverage/`, and call `upload_code_coverage` with `file: "cobertura.xml"`, `language` set to the inferred ecosystem's Linguist name (e.g. `"Go"`, `"Python"`, `"JavaScript"`), and a descriptive `label` (e.g. `"code-coverage/fallback"`)

Files reviewed: 37/39 changed files
Comments generated: 4
Review effort level: Balanced

Copilot · 2026-08-22T19:38:51Z

+    if (typeof entry.file === "string" && path.isAbsolute(entry.file)) {
+      const filePath = entry.file;


Fixed in c900666: upload_code_coverage now resolves relative paths from staging/workspace, enforces GITHUB_WORKSPACE/coverage (or staging) as allowed roots, validates the resolved file, and rewrites staged output safely.

Copilot · 2026-08-22T19:38:51Z

+	if cfg.GitHubToken != "" {
+		steps = append(steps, fmt.Sprintf("          token: %s\n", getEffectiveSafeOutputGitHubToken(cfg.GitHubToken)))
+	}


Fixed in c900666: the upload job now applies token precedence (upload-code-coverage.github-token → safe-outputs.github-token), mints a job-local GitHub App token when configured, and always passes an explicit token input.

Copilot · 2026-08-22T19:38:51Z

+	waitForProcessingTimeout := defaultCodeCoverageWaitForProcessingTimeout
+	if cfg.WaitForProcessingTimeout > 0 {
+		waitForProcessingTimeout = cfg.WaitForProcessingTimeout
+	}


Fixed in c900666: wait-for-processing-timeout now renders the parsed value directly, so explicit 0 is preserved instead of being replaced with 160.

gh-aw-bot · 2026-08-22T19:09:58Z

@copilot this PR looks close, but it still needs a maintainer-ready finish.

Please review the unresolved feedback/check status on the current HEAD, address any remaining blockers, refresh the branch if needed, and leave a concise maintainer handoff with commands and outcomes.
Then run the pr-finisher skill before handing back.

Run: https://github.com/github/gh-aw/actions/runs/32592579426

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 8.21 AIC · ⊞ 9.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-22T19:38:51Z

@copilot this PR looks close, but it still needs a maintainer-ready finish.

Please review the unresolved feedback/check status on the current HEAD, address any remaining blockers, refresh the branc...

Addressed in c900666. I handled the unresolved review blockers, validated locally (make fmt, make lint, make test-unit, make test, targeted JS/Go tests), and confirmed the referenced Sous Chef run has no failed jobs. gh CLI checks are unavailable in this sandbox due missing GH_TOKEN, so PR/check state was reviewed through GitHub MCP APIs.

pelikhan · 2026-08-22T22:03:23Z

 - Choose workflow architecture and patterns: `.github/aw/patterns.md`
 - Optimize token usage and cost: `.github/aw/token-optimization.md`
 - Design long-running multi-agent research workflows: `.github/aw/multi-agent-research.md`
- Add skills or agent plugins requested by the user (`skills:` / `plugins:` frontmatter, never on-the-fly installs): `.github/aw/skills.md`


@copilot patch the go code that generate this file to generate this paragraph

Patched the Go generator in pkg/cli/copilot_agents.go so the OTEL paragraph is guaranteed in generated dispatcher skill output (covered by new generator test). Addressed in 65def23.

pelikhan · 2026-08-22T22:05:49Z

+          "type": "string",
+          "description": "Label identifying this coverage report (e.g., \"code-coverage/unit-tests\", \"code-coverage/jacoco\"). Distinguishes multiple coverage reports uploaded across different workflows or jobs."
+        },
+        "secrecy": {


@copilot secrecy is configured in the safe output frontmatter (default to private) and not set able by the agent

Updated the upload_code_coverage tool schema so secrecy is no longer agent-settable; it is now omitted from tool inputs and remains frontmatter-configured/defaulted. Addressed in 65def23.

pelikhan · 2026-08-22T22:06:13Z

+          "description": "Confidentiality level of the coverage report content (e.g., \"public\", \"internal\", \"private\")."
+        },
+        "integrity": {
+          "type": "string",


@copilot configure schema to use enum

Updated the schema to use an enum for upload_code_coverage.integrity (low|medium|high) in both compiler and runtime copies of safe_outputs_tools.json. Addressed in 65def23.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-23T01:33:22Z

@copilot identity agentic workflows that generate tests and enable the safe output

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-23T02:08:19Z

@copilot identity agentic workflows that generate tests and enable the safe output

Addressed in d602285. I identified the Go test-generation workflows (purelock and spec-enforcer), enabled experimental upload-code-coverage for both, and added instructions to publish Cobertura reports after generated tests validate. The converter is pinned to commit 4afa1205ab3b54ae098dd4724c1657aad10f7484, and the generated upload job now fails clearly if the staging artifact/report is missing before invoking actions/upload-code-coverage.

Validation: make recompile passed (289/289), go test ./pkg/workflow/ -run 'UploadCodeCoverage|ArtifactDownload' passed, impacted Go/JS tests in make agent-report-progress passed, and secret scanning found no secrets. make agent-report-progress still exits non-zero due unrelated pre-existing golint-custom function-length warnings and JS TypeScript config errors; CodeQL timed out and instructed not to rerun.

pelikhan · 2026-08-23T02:10:07Z

@copilot resolve the merge conflicts in this pull request

…ut-for-coverage-upload # Conflicts: # pkg/workflow/artifacts.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-08-23T02:27:38Z

@copilot this PR has merge conflicts and still needs forward progress.

Please run make merge-main to resolve the current conflicts on this branch.
After resolving conflicts, re-check any remaining review feedback, leave a concise maintainer handoff with commands and outcomes, and run the pr-finisher skill.

Run: https://github.com/github/gh-aw/actions/runs/32612677145

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12 AIC · ⌖ 8.23 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-23T02:27:59Z

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts in 0fe777a by merging current main and combining the artifact-download changes from both sides. Validation: make fmt, targeted go test ./pkg/workflow/ -run 'ArtifactDownload|UploadCodeCoverage|ActionsLockJSONFieldsAreSorted|Prune', and make recompile passed. make agent-report-progress reached build/lock/test success but still exits non-zero on existing unrelated custom Go lint and TypeScript config errors. Code review found no comments; CodeQL timed out and instructed not to rerun.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-23T02:49:52Z

@copilot this PR has merge conflicts and still needs forward progress.

Please run make merge-main to resolve the current conflicts on this branch....

Ran make merge-main; it completed cleanly with no new merge commit needed because the branch was already at current main. I also fixed the remaining PR-specific Go lint issue in 8591f7d (coverageToken zero-value declaration in /home/runner/work/gh-aw/gh-aw/pkg/workflow/publish_code_coverage.go).

Validation: make lint, make test-unit, make test, and make recompile passed. make agent-report-progress still exits non-zero only on existing unrelated repository-wide golint-custom issues; its build, lock freshness, impacted Go tests, and impacted JS tests passed. Code review found no comments; CodeQL skipped the trivial lint-only change. CI on 8591f7d has not run yet and needs a maintainer re-trigger.

gh-aw-bot · 2026-08-23T03:45:48Z

@copilot this PR still needs forward progress.

Please refresh the branch state and resolve any remaining merge or CI follow-up items.
Then run the pr-finisher skill and push the remaining implementation or cleanup needed for review.

Run: https://github.com/github/gh-aw/actions/runs/32615850773

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 32.8 AIC · ⌖ 8.34 AIC · ⊞ 7.1K · ◷
_{Comment /souschef to run again}

…ut-for-coverage-upload Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan · 2026-08-23T04:12:16Z

@copilot error in mcp gateway init. ensure logging works.
https://github.com/github/gh-aw/actions/runs/32616981524/job/97139294406

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-23T04:14:52Z

@copilot this PR still needs forward progress.

Please refresh the branch state and resolve any remaining merge or CI follow-up items....

Addressed in 25d5c24 after refreshing the branch with current main (fbed40c). I fixed the remaining PR-specific custom lint issue in pkg/workflow/publish_code_coverage.go by extracting the upload-code-coverage download path to a named constant.

Validation: make fmt, make lint, make test-unit, make test, make recompile, targeted go test ./pkg/workflow/ -run 'UploadCodeCoverage|ArtifactDownload', secret scanning, and code review completed. make agent-report-progress still exits non-zero only on existing unrelated repository-wide largefunc custom lint warnings; its build, lock freshness, impacted Go tests, and impacted JS tests passed. CodeQL timed out and instructed not to rerun.

CI on the new agent-pushed HEAD will be stale until a maintainer re-triggers it.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-23T04:36:42Z

@copilot error in mcp gateway init. ensure logging works.
https://github.com/github/gh-aw/actions/runs/32616981524/job/97139294406

Fixed in b1d7350. The gateway init failure was caused by generated MCP config referencing ${RUNNER_TOOL_CACHE} when that environment variable was not present in the job environment. Generated workflows now populate RUNNER_TOOL_CACHE from ${{ runner.tool_cache }} in the early runtime paths step, before MCP gateway startup. The existing gateway logging captured the validation failure clearly; make recompile propagated the fix to lock files.

Add coverage artifact safe output guidance

9def3dc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Aug 22, 2026

Copilot created this pull request from a session on behalf of pelikhan August 22, 2026 17:33 View session

Copilot started work on behalf of pelikhan August 22, 2026 17:36 View session

Add upload code coverage safe output

ef8954d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 22, 2026 18:35

Copilot AI requested a review from pelikhan August 22, 2026 18:35

pelikhan marked this pull request as ready for review August 22, 2026 18:47

Copilot AI balanced review requested due to automatic review settings August 22, 2026 18:47

Copilot started reviewing on behalf of pelikhan August 22, 2026 18:48 View session

Merge branch 'main' into copilot/add-safe-output-for-coverage-upload

7bb0939

github-actions Bot mentioned this pull request Aug 22, 2026

[pr-sous-chef] PR Sous Chef run report #54661

Closed

Copilot AI reviewed Aug 22, 2026

View reviewed changes

Copilot started work on behalf of gh-aw-bot August 22, 2026 19:10 View session

Copilot AI and others added 2 commits August 22, 2026 19:14

Plan for PR feedback follow-up

5f6becf

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Fix upload-code-coverage path and token fallback handling

c900666

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 22, 2026 19:39

Copilot AI requested a review from gh-aw-bot August 22, 2026 19:39

pelikhan reviewed Aug 22, 2026

View reviewed changes

Copilot started work on behalf of pelikhan August 22, 2026 22:07 View session

Copilot AI and others added 2 commits August 22, 2026 22:11

Plan: address new PR feedback

fa71faf

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Tighten upload-code-coverage schema and generator behavior

65def23

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 22, 2026 22:18

Copilot AI requested a review from pelikhan August 22, 2026 22:18

Merge branch 'main' into copilot/add-safe-output-for-coverage-upload

2b89570

Copilot finished work on behalf of pelikhan August 23, 2026 00:43

Copilot started work on behalf of pelikhan August 23, 2026 01:33 View session

Enable coverage upload for test generators

d602285

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 23, 2026 02:08

Copilot started work on behalf of pelikhan August 23, 2026 02:10 View session

Merge remote-tracking branch 'origin/main' into copilot/add-safe-outp…

0fe777a

…ut-for-coverage-upload # Conflicts: # pkg/workflow/artifacts.go Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 23, 2026 02:28

Copilot started work on behalf of gh-aw-bot August 23, 2026 02:28 View session

Fix upload coverage token lint

8591f7d

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 23, 2026 02:50

Copilot started work on behalf of gh-aw-bot August 23, 2026 03:46 View session

Merge remote-tracking branch 'origin/main' into copilot/add-safe-outp…

fbed40c

…ut-for-coverage-upload Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Fix upload coverage download path lint

25d5c24

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 23, 2026 04:15

Copilot started work on behalf of pelikhan August 23, 2026 04:16 View session

Copilot AI and others added 2 commits August 23, 2026 04:20

Plan CI gateway logging fix

a9bc704

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Set runner tool cache for generated jobs

b1d7350

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 23, 2026 04:37

pelikhan merged commit 2e47d61 into main Aug 23, 2026
47 checks passed

pelikhan deleted the copilot/add-safe-output-for-coverage-upload branch August 23, 2026 04:47

		if (typeof entry.file === "string" && path.isAbsolute(entry.file)) {
		const filePath = entry.file;

Uh oh!

Conversation

Copilot AI commented Aug 22, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Aug 22, 2026

Uh oh!

Copilot AI commented Aug 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Aug 22, 2026

Uh oh!

Copilot AI commented Aug 22, 2026

Uh oh!

pelikhan Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

pelikhan commented Aug 23, 2026

Uh oh!

gh-aw-bot commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

gh-aw-bot commented Aug 23, 2026

Uh oh!

pelikhan commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 22, 2026 •

edited by github-actions Bot

Loading