Skip to content

Fix cross-repo reusable workflow hash check: remove workflow_call event gate and correct workflow_ref assumptions#24924

Open
Copilot wants to merge 3 commits intomainfrom
copilot/fix-cross-repo-workflow-check
Open

Fix cross-repo reusable workflow hash check: remove workflow_call event gate and correct workflow_ref assumptions#24924
Copilot wants to merge 3 commits intomainfrom
copilot/fix-cross-repo-workflow-check

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 6, 2026

Two compounding bugs in check_workflow_timestamp_api.cjs cause the "Check workflow lock file" step to fail with ERR_CONFIG when a reusable workflow is called cross-repo.

Root causes

Bug 1 — Wrong event gate: The referenced_workflows API lookup was gated on eventName === "workflow_call", but inside a reusable workflow GITHUB_EVENT_NAME reflects the original trigger event (e.g. push), not workflow_call. The gate never fired.

Bug 2 — Incorrect workflow_ref assumption: Both GITHUB_WORKFLOW_REF and ${{ github.workflow_ref }} (injected as GH_AW_CONTEXT_WORKFLOW_REF) resolve to the caller's workflow ref inside a reusable workflow, not the callee's. The fallback therefore looked for the lock file in the wrong repo.

Changes

  • check_workflow_timestamp_api.cjs — Remove the eventName === "workflow_call" guard; the referenced_workflows API lookup now always runs when GITHUB_RUN_ID is present. GH_AW_CONTEXT_WORKFLOW_REF is demoted to a pure fallback for when the API finds no matching entry.
// Before — never fired for push/issues/etc. triggers
const eventName = process.env.GITHUB_EVENT_NAME || context.eventName;
if (eventName === "workflow_call") {
  // referenced_workflows lookup
}

// After — always attempts lookup; falls back to GH_AW_CONTEXT_WORKFLOW_REF on miss/failure
const runId = parseInt(process.env.GITHUB_RUN_ID || String(context.runId), 10);
if (Number.isFinite(runId)) {
  // referenced_workflows lookup
}
  • check_workflow_timestamp_api.cjs / compiler_activation_job.go — Correct misleading comments that claimed ${{ github.workflow_ref }} identifies the callee; it identifies the caller.

  • check_workflow_timestamp_api.test.cjs — Replace the "should not call referenced_workflows API for non-workflow_call events" assertion with a test that verifies the API is called (and resolves the correct callee repo) when GITHUB_EVENT_NAME = "push". Update describe-block comments to reflect actual GitHub Actions behavior.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw _wTXDDAYc ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuremote.upstream.url /usr/bin/git 8/001/noflag-a.mgit GOPROXY ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw go /usr/bin/docker git rev-�� --show-toplevel docker /usr/bin/infocmp 4000-56422/test-git go 1/x64/bin/node infocmp (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 1/x64/bin/node /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build3641890617/b396/importcfg -pack /tmp/go-build3641890617/b396/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD ha8_stub.s go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name json ]; then \ cp .github/aw/actions-lock.json pkg/workflow/data/action_pins.json; \ echo "���sed GO111MODULE k GOINSECURE GOMOD GOMODCACHE go sRem�� -json GO111MODULE k/gh-aw/gh-aw/actions/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/asm /usr/bin/git ned-imports-enabgit itmain_branch169rev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha .github/workflows/test.md sh /usr/bin/git licyMinIntegritygit GOPROXY x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git k/gh-aw/gh-aw/.ggit blob /usr/lib/git-cor--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /usr/bin/git git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel /usr/bin/git /usr/bin/git node js/f�� /usr/lib/git-cor--show-toplevel git /opt/hostedtoolcache/go/1.25.8/x64/bin/bash --show-toplevel /usr/lib/git-correv-parse /usr/bin/git bash (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha /tmp/go-build3641890617/b428/semverutil.test -importcfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -s -w -buildmode=exe /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build3641890617/b421/_pkg_.a s/test.md /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -p main -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -v -extld=gcc /usr/bin/git 3316595584/custogit GO111MODULE ache/go/1.25.8/x--show-toplevel git -C /tmp/TestGuardPolicyBlockedUsersCommaSeparatedCompiledOutput3300910297/001 config /usr/bin/git remote.origin.urgit GO111MODULE in/sh /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git 1/x64/bin/node --show-toplevel git /usr/bin/git git cjs --show-toplevel git ache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha g_.a RR0X2oXnN ck GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ sRem�� J-vPE9CJQ GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE 3740908/b006/ GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -v xvLX0kW/sVnmb7t6rev-parse /usr/bin/git g_.a rotocol/go-sdk@vrev-parse 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git 542405692 GO111MODULE /opt/hostedtoolc--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build403git pkg/mod/github.crev-parse /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x-test.v=true /usr/bin/infocmp licyMinIntegritygit s /opt/hostedtoolc--show-toplevel infocmp (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -b feature-branch /usr/bin/git -c=4 -nolocalimports -importcfg git rev-�� --show-toplevel /home/REDACTED/work/gh-aw/gh-aw/pkg/timeutil/format_test.go /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --oneline epo}/actions/runs/4/artifacts /usr/bin/git e GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /opt/hostedtoolcache/node/24.14.1/x64/bin/node */*.ts' '**/*.jsgit GO111MODULE x_amd64/vet node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm /usr/bin/git ithub/workflows UXOD/6NsrvkHbOMlrev-parse e/git git rev-�� --show-toplevel e/git /usr/bin/git thSetup_GorootOrgit -trimpath /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build4033740908/b227/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/modelcontextprotocol/go-sdk@v1.4.1/internal/jsonrpc2/conn.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json onrpc.go 64/bin/go GOINSECURE GOMOD GOMODCACHE ha8_stub.s ode_�� -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha user.name resolved$ /usr/bin/git Gitbranch_with_hgit Gitbranch_with_hrev-parse x_amd64/compile git conf�� user.name Test User /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE /opt/hostedtoolc--show-toplevel git add test.txt s/2/artifacts /usr/bin/git runs/20260406-16git **/*.cjs x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel infocmp otOrdering166051--show-toplevel node (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha ub.actor }} x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE /usr/sbin/sh git rev-�� --show-toplevel sh /usr/bin/git npx prettier --cgit GOPROXY 1/x64/bin/node git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel 1/x64/bin/node /usr/bin/docker node (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha 999 -trimpath /usr/lib/git-core/git-receive-pack -p net/http/httptrarev-parse -lang=go1.25 git-receive-pack /tmp�� -buildid l /usr/bin/git -goversion go1.25.8 -c=4 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha title }} f() { test "$1" = get && echo "******"; }; f get /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link 39/001/test-simpgit GO111MODULE 8d519d9/node_mod--show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -o /tmp/go-build2192063689/b411/parser.test -importcfg /usr/bin/git -s -w -buildmode=exe git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel git 1/x64/bin/node --show-toplevel ache/node/24.14.rev-parse /usr/bin/git git rev-�� --show-toplevel git 1/x64/bin/node --show-toplevel git /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha run --auto /usr/bin/git --detach GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git */*.ts' '**/*.jsgit GO111MODULE x_amd64/compile git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha GOMODCACHE go /usr/bin/git ithub-script/gitgit GO111MODULE /opt/hostedtoolc--show-toplevel git conf�� user.name l ache/node/24.14.1/x64/bin/node runs/20260406-16git GOPROXY x_amd64/vet ache/node/24.14.1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel e/git /usr/bin/git git rev-�� --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel infocmp /usr/bin/git node (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha k/gh-aw/gh-aw/.github/workflows -dwarf=false /usr/bin/git go1.25.8 -c=4 -nolocalimports git add . l /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha s/^session\.gc_maxlifetime=\(.*\)$/\1/p go ache/node/24.14.1/x64/bin/node plate-expressiongit GO111MODULE ache/go/1.25.8/x--show-toplevel git t-21�� k/gh-aw/gh-aw/.github/workflows/archie.md master /usr/bin/git 01/main.md GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git 1/x64/bin/node --show-toplevel ache/node/24.14.rev-parse /usr/bin/git git rev-�� --show-toplevel git 1/x64/bin/node --show-toplevel git /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha pEMh7vJrOedkwbSq8VpX/pEMh7vJrOedkwbSq8VpX -dwarf=false /bin/sh go1.25.8 -symabis /tmp/go-build403--show-toplevel /bin/sh -c git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch3224777978/001' l 1/x64/bin/node -json GO111MODULE 64/bin/go 1/x64/bin/node (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha s/^session\.save_handler=\(.*\)$/\1/p go /usr/bin/git 2024685173/.githgit GO111MODULE ache/go/1.25.8/x--show-toplevel git comm�� -m initial commit /usr/bin/git 9803/001/stabiligit GO111MODULE ache/go/1.25.8/x--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git 1/x64/bin/node -nilfunc git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name @v1.1.3/base64/base64.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env ithub/workflows h00yucQ7c x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 SUy_HbpQE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile k/gh�� 1718361401 KmEF_rn9z 64/pkg/tool/linux_amd64/vet GOINSECURE pproxy erignore 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE n-dir/sh GOINSECURE GOMOD GOMODCACHE go env 9803/001/stability-test.md GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name LsRemoteWithRealGitbranch_with_hyphen4212978302/001' 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env rity453750439/001 pMTTxllzq 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env tants.go ne_constants.go 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name GO111MODULE ules/.bin/sh GOINSECURE GOMOD GOMODCACHE go env 1205692231/.github/workflows GO111MODULE 64/pkg/tool/linux_amd64/cgo GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/cgo (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 1y3cTijPK 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a UHEwN-QbQ x_amd64/compile GOINSECURE a20poly1305 GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts' '**/*.json' --ignore-path ../../../.prettierignore GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE bug GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a k3aRqV4ci 64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile k/gh�� g_.a JytyNgNV_ 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD erignore 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name mLsRemoteWithRealGitcustom_branch4024404897/001' 86_64/sh GOINSECURE GOMOD GOMODCACHE go env */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 6D-KwQuTc 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 _3ywvdE5S 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/home/REDACTED/work/gh-aw/gh-aw/scripts/lint_error_messages_test.go k/gh�� 1718361401 LamLkoYmy 64/pkg/tool/linux_amd64/link GOINSECURE pguts erignore 64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c3843889312/001 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a AUUx1O_e3 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 _56Gjvce9 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile k/gh�� 1718361401 InX8DV7o_ ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c3843889312/0remote.origin.url GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name /cpu/byteorder.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env ithub/workflows V3gqgd2UJ sole.test GOINSECURE o8601 GOMODCACHE sole.test (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile k/gh�� 1718361401 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE go-sdk/internal/rev-parse erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/bin/sh GOINSECURE GOMOD GOMODCACHE go env y_with_repos_array_c3843889312/001 GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url env ut1084828294/001 eF_9lmWUN 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel qb/UKCb3IoroNOI9029NoPl/_4g12Odpconfig /usr/bin/git 132965/001 GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a CLJOlIPxV x_amd64/link git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha user.name Test User /usr/bin/git ithout_min-integgit config 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git /repos/actions/g/bin/sh --jq om/myorg/myrepo.git-upload-pack 'origin' git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 1/x64/bin/node /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha g_.a LvhFNvMoO 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com m/_n�� ortcfg Tbt35DxwQ ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha ository }} GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE /usr/bin/sh GOINSECURE GOMOD GOMODCACHE sh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git ons-test39172652node rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha SameOutput302092-errorsas GO111MODULE k/_temp/ghcca-no-nilfunc GOINSECURE erignore GOMODCACHE go env FieldEnforcement-errorsas GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm 6327�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env lGitmain_branch1696327512/001' lGitmain_branch1696327512/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha CommaSeparatedCompiledOutput948831365/001 GO111MODULE bash GOINSECURE GOMOD erignore go env -json GO111MODULE /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha edOutput1831276088/001 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE obyte 64/src/math/floo--show-toplevel 64/pkg/tool/linux_amd64/vet env ript formatting validated" 57OuoO-7M ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha 0976999/001 0976999/002/work-ifaceassert /opt/hostedtoolc-nilfunc GOINSECURE GOMOD GOMODCACHE go env '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branchremote.origin.url '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmaster_branch468831701/001' /home/REDACTED/work/gh-aw/gh-aw/actions/setup/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE ieAM-Lz/1rKZ6KO_config (http block)
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel git /usr/bin/git ithub-script/gitnode remote Name,createdAt,startedAt,updated--show-toplevel git rev-�� --show-toplevel git /usr/bin/git /tmp/gh-aw-test-node (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a Kt0zQSK0W ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go 1/x6�� b/workflows GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion rity2200663506/0git GO111MODULE x_amd64/asm ache/go/1.25.8/x64/pkg/tool/linux_amd64/link rev-�� 2063689/b424/stringutil.test x_amd64/asm 2063689/b424/importcfg.link -json GO111MODULE 64/bin/go 8IwtLslUObn8g/hVrepos/{owner}/{repo}/actions/runs/4/artifacts (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -importcfg /tmp/go-build3641890617/b410/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env on 2>&1 | grep --p GO111MODULE ules/.bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD y.s go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE modules/@npmcli/run-script/lib/node-gyp-bin/node GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3641890617/b396/cli.test /tmp/go-build3641890617/b396/cli.test -test.testlogfile=/tmp/go-build3641890617/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -importcfg /tmp/go-build4033740908/b220/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/sys@v0.42.0/cpu/byteorder.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build1452875291/b396/cli.test /tmp/go-build1452875291/b396/cli.test -test.testlogfile=/tmp/go-build1452875291/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel git-receive-pack-c /usr/bin/git go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /tmp/go-build2192063689/b223/cli.test /tmp/go-build2192063689/b223/cli.test -test.testlogfile=/tmp/go-build2192063689/b223/testlog.txt -test.paniconexit0 -test.timeout=10m0s env */*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ck GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ath ../../../.pr**/*.json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name 1303111714/.github/workflows GO111MODULE ache/go/1.25.8/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/sh GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

…e gate

Remove the `eventName === "workflow_call"` guard in check_workflow_timestamp_api.cjs.
Inside a reusable workflow, GITHUB_EVENT_NAME reflects the original trigger event
(e.g., "push"), NOT "workflow_call", so the referenced_workflows API lookup was never
firing for cross-repo scenarios triggered by non-workflow_call events.

Also corrects misleading comments claiming ${{ github.workflow_ref }} identifies the
callee; in practice it resolves to the caller's workflow ref. The referenced_workflows
API is now the primary callee-resolution mechanism for all event types.

Updates the test that previously asserted the API was NOT called for non-workflow_call
events — now it asserts the API IS called (and resolves the callee correctly).

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6606ec27-bb3c-4249-91fe-37b1ea229829

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix cross-repo workflow call hash check issue Fix cross-repo reusable workflow hash check: remove workflow_call event gate and correct workflow_ref assumptions Apr 6, 2026
Copilot AI requested a review from pelikhan April 6, 2026 16:44
@pelikhan pelikhan marked this pull request as ready for review April 6, 2026 16:46
Copilot AI review requested due to automatic review settings April 6, 2026 16:46
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes cross-repo reusable workflow lock-file checking by correctly resolving the callee workflow repo/ref via the Actions referenced_workflows API (instead of relying on GITHUB_EVENT_NAME and github.workflow_ref, which reflect the caller/original trigger context in reusable workflow scenarios).

Changes:

  • Remove the eventName === "workflow_call" gate and always attempt referenced_workflows resolution when GITHUB_RUN_ID is valid.
  • Clarify compiler/script comments about github.workflow_ref resolving to the caller (not the callee).
  • Update unit tests to assert referenced_workflows is used even when GITHUB_EVENT_NAME is e.g. "push".
Show a summary per file
File Description
pkg/workflow/compiler_activation_job.go Updates comments describing how github.workflow_ref behaves and how the script resolves the callee repo.
actions/setup/js/check_workflow_timestamp_api.cjs Removes the event-name guard and prioritizes referenced_workflows API lookup, with fallback behavior retained.
actions/setup/js/check_workflow_timestamp_api.test.cjs Adjusts test expectations and commentary to match real reusable workflow context behavior and the new lookup strategy.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 3

Comment on lines +86 to +93
// Always attempt referenced_workflows API lookup to resolve the callee repo/ref.
// This handles cross-repo reusable workflow scenarios reliably.
//
// IMPORTANT: GITHUB_EVENT_NAME inside a reusable workflow reflects the ORIGINAL trigger
// event (e.g., "push", "issues"), NOT "workflow_call". We therefore cannot rely on event
// name to detect cross-repo scenarios and must always attempt the referenced_workflows
// API lookup.
//
Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The referenced_workflows lookup now runs for every finite GITHUB_RUN_ID, which adds an extra Actions API call even when GITHUB_WORKFLOW_REF/GH_AW_CONTEXT_WORKFLOW_REF already point at the current lock workflow (common same-repo / non-reusable runs). Consider short-circuiting the getWorkflowRun call unless the env workflow ref does NOT reference GH_AW_WORKFLOW_FILE (or unless repo/ref parsing indicates a workflow_call context), to reduce API usage and avoid rate-limit/permission noise in normal runs.

Copilot uses AI. Check for mistakes.
Comment on lines +54 to +55
// callee's repo/ref from the caller's run object. GH_AW_CONTEXT_WORKFLOW_REF is only
// used as a fallback when the API lookup is unavailable or finds no matching entry.
Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The script comments say GH_AW_CONTEXT_WORKFLOW_REF is only a fallback when the referenced_workflows API lookup misses/unavailable, but later logging still states GH_AW_CONTEXT_WORKFLOW_REF ... (used for source repo resolution) even when the API successfully resolves the callee. Update the log wording (or gate it on whether fallback was actually used) to avoid misleading diagnostics.

Suggested change
// callee's repo/ref from the caller's run object. GH_AW_CONTEXT_WORKFLOW_REF is only
// used as a fallback when the API lookup is unavailable or finds no matching entry.
// callee's repo/ref from the caller's run object. GH_AW_CONTEXT_WORKFLOW_REF remains an
// available parsed input here, but the API result is authoritative; the env ref serves as
// the fallback when the API lookup is unavailable or finds no matching entry.

Copilot uses AI. Check for mistakes.
Comment on lines 797 to 806
@@ -798,17 +798,22 @@ engine: copilot
// Regression test for https://github.com/github/gh-aw/issues/23935
// When a reusable workflow is invoked cross-repo via workflow_call:
// - GITHUB_WORKFLOW_REF (env var) = top-level CALLER's workflow (e.g., repo-b/caller.yml@main)
// - GH_AW_CONTEXT_WORKFLOW_REF (injected from ${{ github.workflow_ref }}) = the CALLEE's reusable workflow
// Without this fix, the script would look for lock files in the caller's repo (404).
// - GH_AW_CONTEXT_WORKFLOW_REF (injected from ${{ github.workflow_ref }}) = CALLER's workflow too
// (github.workflow_ref resolves to the caller in reusable workflow contexts)
// The referenced_workflows API lookup is the primary fix; GH_AW_CONTEXT_WORKFLOW_REF is
// used as a fallback. These tests cover the fallback path (no GITHUB_RUN_ID set) where
// GH_AW_CONTEXT_WORKFLOW_REF happens to correctly identify the callee (e.g., same-repo case).

Copy link

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This describe block documents that github.workflow_ref resolves to the caller in reusable workflow contexts, but the tests still set GH_AW_CONTEXT_WORKFLOW_REF to a different (callee) repo and treat it as a cross-repo fix. That scenario can’t occur from ${{ github.workflow_ref }} in cross-repo reusable workflows, so the test name/comments are misleading. Suggest re-framing these as “manual override/fallback env var” tests, or adjusting the setup to a realistic same-repo case where caller==callee repo (so fallback actually works).

See below for a potential fix:

  describe("manual GH_AW_CONTEXT_WORKFLOW_REF fallback override", () => {
    // Regression test for https://github.com/github/gh-aw/issues/23935
    // In reusable workflow contexts, both GITHUB_WORKFLOW_REF and
    // ${{ github.workflow_ref }} resolve to the caller's workflow.
    // The referenced_workflows API lookup is the primary fix for identifying the callee
    // workflow. These tests cover the fallback path used when that API lookup is unavailable
    // (for example, no GITHUB_RUN_ID is set) and GH_AW_CONTEXT_WORKFLOW_REF is manually
    // provided with the intended source workflow ref.

    beforeEach(() => {
      process.env.GH_AW_WORKFLOW_FILE = "test.lock.yml";
      // Simulate a caller workflow context where GITHUB_WORKFLOW_REF points at the caller.
      process.env.GITHUB_WORKFLOW_REF = "caller-owner/caller-repo/.github/workflows/caller.yml@refs/heads/main";
      process.env.GITHUB_REPOSITORY = "caller-owner/caller-repo";
      // Manually inject GH_AW_CONTEXT_WORKFLOW_REF to exercise the fallback/override path.
      // This value is intentionally the callee repo and is not meant to model the literal
      // value of ${{ github.workflow_ref }} in a cross-repo reusable workflow.
      process.env.GH_AW_CONTEXT_WORKFLOW_REF = "platform-owner/platform-repo/.github/workflows/test.lock.yml@refs/heads/main";
    });

    it("should prefer a manually provided GH_AW_CONTEXT_WORKFLOW_REF over GITHUB_WORKFLOW_REF for source repo resolution", async () => {

Copilot uses AI. Check for mistakes.
@pelikhan
Copy link
Copy Markdown
Collaborator

pelikhan commented Apr 6, 2026

@copilot review comments

- Add short-circuit: skip getWorkflowRun API call when the env workflow ref
  (GH_AW_CONTEXT_WORKFLOW_REF / GITHUB_WORKFLOW_REF) already ends with the
  current workflow file, avoiding unnecessary API calls for same-repo runs
- Fix misleading log message: "(used for source repo resolution)" →
  "(available as env fallback)" — the env var is a fallback, not necessarily
  what was used when the API lookup succeeded
- Rename test describe block: "cross-repo invocation via workflow_call
  (GH_AW_CONTEXT_WORKFLOW_REF fix)" → "manual GH_AW_CONTEXT_WORKFLOW_REF
  fallback override" — better reflects that this tests the manual env override
  path, not a realistic cross-repo scenario from github.workflow_ref
- Add test: "should skip referenced_workflows API when env ref already matches
  the workflow file, even with a valid GITHUB_RUN_ID" — explicitly covers the
  short-circuit behaviour

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/afa907f4-0878-41a8-b553-23fbe064225d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 6, 2026

@copilot review comments

Addressed all three reviewer points in commit dccf248:

  1. Short-circuit added — the getWorkflowRun API call is now skipped when the env workflow ref (GH_AW_CONTEXT_WORKFLOW_REF / GITHUB_WORKFLOW_REF) already ends with the current GH_AW_WORKFLOW_FILE. This avoids unnecessary API calls in normal same-repo / non-reusable runs even when GITHUB_RUN_ID is set. A new test verifies this behaviour.

  2. Log message fixed(used for source repo resolution) changed to (available as env fallback) so the log is accurate regardless of whether the API or the fallback was actually used for resolution.

  3. Describe block renamed"cross-repo invocation via workflow_call (GH_AW_CONTEXT_WORKFLOW_REF fix)""manual GH_AW_CONTEXT_WORKFLOW_REF fallback override" with updated comments clarifying these tests exercise the manual env-override path (short-circuit fires because env ref already ends with the workflow file), not a realistic cross-repo scenario.

@github-actions github-actions bot mentioned this pull request Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cross-repo workflow_call: hash check fails because github.workflow_ref and GITHUB_EVENT_NAME resolve to caller, not callee

3 participants