Repository navigation
chore: sync actions from [email protected] - #292
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive session publication and queue authorization changes need human validation, with confirmed regressions still unresolved.
3 open issues
What changed in this PR
Syncs the action runtime from [email protected], bringing upstream session-processing, work-queue, and diagnostic updates into this distribution.
Changes:
- Adds protected command-output ingestion and stricter session validation and redaction.
- Adds on-demand queue pool installation and historical policy reconstruction.
- Updates evaluation isolation, checkout ref discovery, assignment preflight checks, and error reporting.
| File | Description |
|---|---|
setup/setup.sh |
Copies the new pool-installation helper into runtime bundles. |
setup/session_parsers.go |
Embeds protected-output and pool-installation helpers. |
setup/session_parsers_test.go |
Adds an embedded log-parser bootstrap loading test. |
setup/js/work_queue_worker_child_fixture_generator.cjs |
Removes AW authorization from legacy fixture policy. |
setup/js/work_queue_replay.cjs |
Supports pool installation and preserves policy checkpoint history. |
setup/js/work_queue_pool_install.cjs |
Verifies and publishes additive pool configurations. |
setup/js/work_queue_policy.cjs |
Adds installation permissions and historical policy lookup. |
setup/js/work_queue_policy_checks.cjs |
Tests historical policy validation boundaries. |
setup/js/work_queue_logging.cjs |
Adds bounded GraphQL diagnostics and queue error explanations. |
setup/js/work_queue_issue_coordination.cjs |
Identifies lock and unlock failures in diagnostics. |
setup/js/work_queue_issue_api.cjs |
Supplies operation context for mutation diagnostics. |
setup/js/work_queue_dispatch.cjs |
Integrates pool installation and accepted-request policy lookup. |
setup/js/work_queue_deployment.cjs |
Initializes added pools without resetting existing deployments. |
setup/js/work_queue_delivery.cjs |
Updates delivery validation codes and scope-error matching. |
setup/js/work_queue_control_receipts.cjs |
Verifies controls against their acceptance-time policy. |
setup/js/work_queue_conformance_checks.cjs |
Updates the expected shared operation count. |
setup/js/work_queue_claim_scope.cjs |
Adds coded scope errors and staged-mode diagnostics. |
setup/js/unified_session.cjs |
Adds protected collection without shared-log fallbacks. |
setup/js/start_mcp_gateway.cjs |
Standardizes startup and configuration error reporting. |
setup/js/session_artifact.cjs |
Detects structural changes caused by session redaction. |
setup/js/safe_outputs_tools.json |
Emphasizes existing constraints in the comment tool description. |
setup/js/safe_outputs_tools_loader.cjs |
Adds specific copy and file-write error codes. |
setup/js/run_evals.cjs |
Guards evaluator input and refreshes split prompt files. |
setup/js/reconcile_work_queue_run.cjs |
Adds structured reconciliation error metadata. |
setup/js/protected_command_output.cjs |
Validates private captures and replaces untrusted session artifacts. |
setup/js/pr_lifecycle.cjs |
Logs skipped lifecycle checks in staged mode. |
setup/js/model_pin_check.cjs |
Adds configuration and missing-reflection error codes. |
setup/js/log_parser_bootstrap.cjs |
Integrates protected capture verification and publication safeguards. |
setup/js/handle_agent_failure.cjs |
Renders batch assignment diagnostics alongside item errors. |
setup/js/grader_session.cjs |
Codes invalid grader-session input errors. |
setup/js/generate_safe_outputs_tools.cjs |
Uses the dedicated tool-copy error code. |
setup/js/error_codes.cjs |
Defines shared specialized error constants. |
setup/js/empty_output_outcome.cjs |
Honors protected capture during outcome collection. |
setup/js/constants.cjs |
Defines the aggregate protected-capture byte limit. |
setup/js/collect_ndjson_output.cjs |
Requires session collection when protected capture is enabled. |
setup/js/checkout_dynamic.cjs |
Discovers matching remote refs before fetching them. |
setup/js/check_version_updates.cjs |
Codes compiler compatibility and provenance failures. |
setup/js/assign_to_agent.cjs |
Adds credential preflight and batch failure diagnostics. |
Review effort: Max
| function collectUnifiedSession({ | ||
| rootDir = "/tmp/gh-aw", | ||
| engine, | ||
| protectedSessionCapture = false, |
|
|
||
| function setFailed(message) { | ||
| const text = String(message).replace(/^(?:ERROR|FATAL):\s*/, ""); | ||
| core.setFailed(/^ERR_[A-Z]+:/.test(text) ? text : `${ERR_SYSTEM}: ${text}`); |
Comment on lines
+604
to
+605
| for (const pool of new Set(intent.parameters.nodes.map(node => node.pool ?? "default"))) | ||
| if (!Object.hasOwn(candidatePolicy.pools, pool)) throw queueError("work_queue_pool_not_installed", "submission pool is not installed in Policy"); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync of actions from gh-aw at
v0.93.4.