Add fix codemods for Copilot web-fetch and reserved inputs by Copilot · Pull Request #66556 · github/gh-aw

Copilot · 2026-10-07T12:14:08Z

Compatibility audits found strict-compilation failures from native Copilot web-fetch settings and user-declared workflow_dispatch.inputs.aw_context. Add automatic fixes for both; Codex bash allow-list restrictions retain their existing guided, manual remediation.

Copilot: Remove tools.web-fetch for Copilot CLI workflows; preserve it for Copilot SDK mode and other engines.
Reserved input: Remove aw_context from on.workflow_dispatch.inputs, preserving other inputs and comments.
Codex: Keep the existing manual guidance; automatically widening bash permissions would change workflow behavior.

# Before
engine:
  id: copilot
tools:
  web-fetch:
on:
  workflow_dispatch:
    inputs:
      aw_context:
        type: string

# After gh aw fix
engine:
  id: copilot
on:
  workflow_dispatch:

Fixes [AW Top 10] 02 Add codemods for audited compile gaps #66486

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

The migrations can delete compatible settings or unrelated text and leave some compilation failures unresolved.

Review effort: Balanced
Findings: 4

Open (4)

Resolve inherited engine before removing web-fetch · New
Support flow mappings and quoted keys in field removals · New
Restrict removals to YAML mapping entries · New
Preserve empty inputs as an object when removing aw_context · New

What changed in this PR

Adds gh aw fix migrations for two audited compilation failures while retaining manual guidance for Codex bash restrictions.

Changes:

Removes unsupported Copilot CLI web-fetch settings and reserved aw_context inputs.
Registers both migrations and adds preservation, idempotence, and strict-compilation tests.

File	Description
`pkg/cli/fix_codemods.go`	Registers both migrations.
`pkg/cli/fix_codemods_test.go`	Updates registry and ordering expectations.
`pkg/cli/codemod_workflow_dispatch_aw_context.go`	Removes reserved dispatch inputs.
`pkg/cli/codemod_workflow_dispatch_aw_context_test.go`	Tests input removal and compilation.
`pkg/cli/codemod_copilot_web_fetch.go`	Removes unsupported Copilot fetch settings.
`pkg/cli/codemod_copilot_web_fetch_test.go`	Tests removal and compatible configurations.

Copilot · 2026-10-07T16:12:35Z

+			if extractEngineIDFromFrontmatter(frontmatter) != "copilot" {
+				return content, false, nil
+			}
+
+			_, engineConfig, _ := (&workflow.Compiler{}).ExtractEngineConfig(frontmatter)


Resolved the effective engine and SDK settings through ApplyWithContext; when resolution fails, the codemod now preserves tools.web-fetch. Added import/include coverage in daa2f746.

Copilot · 2026-10-07T16:12:35Z

+			}
+
+			newContent, applied, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) {
+				result, modified := removeFieldFromBlock(lines, "web-fetch", "tools")


Both removals now edit YAML mapping nodes, covering flow maps and quoted keys while retaining siblings. Regression cases were added in daa2f746.

Copilot · 2026-10-07T16:12:35Z

+					return lines, false
+				}
+				dispatchEnd := frontmatterBlockEnd(lines, dispatchLine, len(getIndentation(lines[dispatchLine])))
+				block, modified := removeFieldFromBlock(lines[dispatchLine:dispatchEnd], "aw_context", "inputs")


The removals now follow the actual YAML mapping path, so matching text inside block scalars remains untouched. Added literal-text regression tests in daa2f746.

Copilot · 2026-10-07T16:12:35Z

+				block, modified := removeFieldFromBlock(lines[dispatchLine:dispatchEnd], "aw_context", "inputs")
+				if !modified {
+					return lines, false
+				}


When the reserved input is the only entry, the codemod now leaves inputs: {} and preserves header/surviving comments. Added compiler-valid regression cases in daa2f746.

gh-aw-bot · 2026-10-07T14:30:27Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/cli/codemod_copilot_web_fetch.go:21): With no local engine declaration, these checks default to Copilot CLI even when an import or markdown include supplies Copilot SDK or another engine. A compatible workflow with local tools.web-fetch therefore loses a supported tool. The compiler resolves these inherited settings in resolveEngineFromIncludesAndImports. Use ApplyWithContext to resolve the effective engine and SDK setting before removing the tool, and preserve the setting if resolution fails. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_copilot_web_fetch.go:39): The parsed preconditions accept valid YAML forms that these line-based transforms cannot remove. For example, tools: {web-fetch: true} and a block entry web-fetch: true remain unchanged. The reserved-input codemod likewise misses on: {workflow_dispatch: {inputs: {aw_context: {type: string}}}} because it searches only subsequent lines. In each case gh aw fix leaves the original compiler error unresolved. Support flow mappings and quoted keys in both removals while preserving siblings and comments, and add regression cases. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_workflow_dispatch_aw_context.go:46): removeFieldFromBlock treats matching text at any depth as a YAML key. If a sibling task input has a description: | containing aw_context: example, removing the reserved input also deletes that description line. The new web-fetch codemod has the same problem: passing all frontmatter lines can delete a tools: / web-fetch: example inside a top-level multiline description. Restrict both removals to the actual mapping entries using YAML-aware boundaries, and test that literal text remains unchanged. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_workflow_dispatch_aw_context.go:49): When aw_context is the only input, an inline comment on inputs: or a surviving comment underneath it makes the helper retain an empty header. YAML parses that as null, but the workflow_dispatch schema requires inputs to be an object. The fix reports success while compilation still fails. Rewrite the retained header as inputs: {} while preserving comments, and add regression cases for both comment forms. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 4b88a27
Sous-chef work: 0b157b59aec97704ab535dfb401bfe3319372d8569d12fbb723b8b1073659d0c 6261fe9675c197634fa2fac82956be79d27adecc55739e60c2cd1ff8728f82d0 a5b10f7e5aaac0e4079ff0c349cc3a004caba737eaf97fc87a0415bc9a0f7928 b5e3b45053c256a6fd32920bac11fb56c465fae41383cd97c281b8842904f2e5
Sous-chef state: c9841d98ef10469c894592bc9cbaab79c0f43d00aab4a04b0d5b35720bcdda2f

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.67 AIC · ⌖ 7.25 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

…-codemods Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

gh-aw-bot · 2026-10-07T15:24:48Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/cli/codemod_copilot_web_fetch.go:21): With no local engine declaration, these checks default to Copilot CLI even when an import or markdown include supplies Copilot SDK or another engine. A compatible workflow with local tools.web-fetch therefore loses a supported tool. The compiler resolves these inherited settings in resolveEngineFromIncludesAndImports. Use ApplyWithContext to resolve the effective engine and SDK setting before removing the tool, and preserve the setting if resolution fails. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_copilot_web_fetch.go:39): The parsed preconditions accept valid YAML forms that these line-based transforms cannot remove. For example, tools: {web-fetch: true} and a block entry web-fetch: true remain unchanged. The reserved-input codemod likewise misses on: {workflow_dispatch: {inputs: {aw_context: {type: string}}}} because it searches only subsequent lines. In each case gh aw fix leaves the original compiler error unresolved. Support flow mappings and quoted keys in both removals while preserving siblings and comments, and add regression cases. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_workflow_dispatch_aw_context.go:46): removeFieldFromBlock treats matching text at any depth as a YAML key. If a sibling task input has a description: | containing aw_context: example, removing the reserved input also deletes that description line. The new web-fetch codemod has the same problem: passing all frontmatter lines can delete a tools: / web-fetch: example inside a top-level multiline description. Restrict both removals to the actual mapping entries using YAML-aware boundaries, and test that literal text remains unchanged. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)
Review (pkg/cli/codemod_workflow_dispatch_aw_context.go:49): When aw_context is the only input, an inline comment on inputs: or a surviving comment underneath it makes the helper retain an empty header. YAML parses that as null, but the workflow_dispatch schema requires inputs to be an object. The fix reports success while compilation still fails. Rewrite the retained header as inputs: {} while preserving comments, and add regression cases for both comment forms. - Add fix codemods for Copilot web-fetch and reserved inputs #66556 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 92f6331
Sous-chef work: 0b157b59aec97704ab535dfb401bfe3319372d8569d12fbb723b8b1073659d0c 6261fe9675c197634fa2fac82956be79d27adecc55739e60c2cd1ff8728f82d0 a5b10f7e5aaac0e4079ff0c349cc3a004caba737eaf97fc87a0415bc9a0f7928 b5e3b45053c256a6fd32920bac11fb56c465fae41383cd97c281b8842904f2e5
Sous-chef state: c28447fc517927b23c6da38bdaa9e0b31e276e28bb613d846334a7f403f43bbc

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 4.09 AIC · ⌖ 6.51 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

gh-aw-bot · 2026-10-07T16:30:38Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Fix failing check github-advanced-security (FAILURE): https://github.com/github/gh-aw/actions/runs/37650223259/job/112891323309.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: daa2f74
Sous-chef work: 960a6fe297781e0f1e1c8c03fa3740110735e1332e99a040b5aa7b1b6d14a3f2
Sous-chef state: 8d0b18933b1c4c1587ce4345cbfef389a243ef67596603bc07c0955e5afcdd95

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 2.88 AIC · ⌖ 7.46 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

…-codemods Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-10-07T16:50:53Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged the latest main in b52582f. The advanced-security logs show make deps-dev failed during go mod download with an HTTP/2 INTERNAL_ERROR from proxy.golang.org, before the build; local build, lint, workflow drift checks, and impacted tests pass, so there is no code change to make for this transient registry failure. The four review findings already have substantive replies and fixes from daa2f74; this environment does not expose a review-thread resolution operation, so those threads remain unresolved. CI needs a human-triggered rerun.

github-actions · 2026-10-07T20:31:57Z

🎉 This pull request is included in a new release.

Release: v0.91.5

Initial plan

f8423bf

Copilot AI assigned Copilot and pelikhan Oct 7, 2026

Copilot started work on behalf of pelikhan October 7, 2026 12:14 View session

Copilot AI linked an issue Oct 7, 2026 that may be closed by this pull request

[AW Top 10] 02 Add codemods for audited compile gaps #66486

Closed

2 tasks

Add compatibility codemods for audited errors

4b88a27

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add codemods for audited compile gaps~~ Add fix codemods for Copilot web-fetch and reserved inputs Oct 7, 2026

Copilot finished work on behalf of pelikhan October 7, 2026 12:34

Copilot AI requested a review from pelikhan October 7, 2026 12:34

pelikhan marked this pull request as ready for review October 7, 2026 13:56

Copilot AI balanced review requested due to automatic review settings October 7, 2026 13:56

Copilot started reviewing on behalf of pelikhan October 7, 2026 13:57 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 7, 2026

[pr-sous-chef] 🍳 PR Sous Chef Summary: 4 PRs nudged toward completion #66387

Closed

Copilot started work on behalf of gh-aw-bot October 7, 2026 14:32 View session

Merge remote-tracking branch 'origin/main' into copilot/aw-top-10-add…

92f6331

…-codemods Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot started work on behalf of gh-aw-bot October 7, 2026 15:25 View session

Make codemod removals YAML-aware

daa2f74

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 7, 2026 16:14

Copilot AI requested a review from gh-aw-bot October 7, 2026 16:14

Copilot started work on behalf of gh-aw-bot October 7, 2026 16:31 View session

Merge remote-tracking branch 'origin/main' into copilot/aw-top-10-add…

b52582f

…-codemods Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

pelikhan merged commit d10c61b into main Oct 7, 2026
1 of 2 checks passed

pelikhan deleted the copilot/aw-top-10-add-codemods branch October 7, 2026 16:44

Copilot AI restored the copilot/aw-top-10-add-codemods branch October 7, 2026 16:51

Copilot finished work on behalf of gh-aw-bot October 7, 2026 16:52

Navigation Menu

Repository navigation

Add fix codemods for Copilot web-fetch and reserved inputs - #66556

Add fix codemods for Copilot web-fetch and reserved inputs#66556
pelikhan merged 5 commits into
mainfrom
copilot/aw-top-10-add-codemods

Copilot AI commented Oct 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

Copilot AI Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

gh-aw-bot commented Oct 7, 2026

Uh oh!

Uh oh!

Copilot AI commented Oct 7, 2026

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 7, 2026 •

edited

Loading