Fix agentic workflow markers removed from safe outputs

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \

[vitek-karas]

Summary

Several agentic workflows used HTML comments as machine-readable markers. That does not work: gh-aw removes agent-provided HTML comments when it sanitizes safe-output text. The comments were therefore not present in the posted issue or PR content, so later workflow runs could not reliably recognize earlier work. On #128405, this allowed ci-failure-fix to post two different handoff comments.

This change replaces those comments with markers that survive publishing:

• safe-outputs.data where the output type supports structured data.
• Stable visible Markdown fields where structured data is not supported or would break the required content format.

Existing visible markers are still recognized so older workflow output continues to work.

Changes by workflow

• ci-failure-fix: Adds structured identifiers to fix PRs, help-wanted PRs, and handoff comments. Deduplication now checks every comment instead of assuming comments are at a fixed position, and it still recognizes older visible markers.
• closed-issue-reference-check: Adds structured identifiers to advisory comments. The pre-check skips issues that contain either the new structured marker or the older workflow-specific marker and advisory heading.
• ci-failure-scan: Moves KBE authoring guidance and the verified-match count into collapsed, clearly labeled sections. KBE bodies still contain exactly one JSON block, as required by Build Analysis.
• ci-failure-scan-feedback: Reads the new ci-failure-fix identifiers while keeping compatibility with older markers. Its tracker identity and window are stored in a collapsed visible section, and tracker updates explicitly replace the body instead of appending to it.

The shared workflow guidance now documents that HTML comments are removed and explains when to use structured data or visible fields. The affected generated workflows were refreshed with gh-aw v0.83.5.

Related change

#131996 is the repository-wide mechanical refresh to gh-aw v0.83.5. This PR contains the workflow behavior and authoring changes, and regenerates the affected workflows with the same compiler version.

Validation

• Compiled and validated the affected workflows with gh-aw v0.83.5.
• Ran poutine and zizmor on the changed workflows.
• Checked the KBE templates keep exactly one JSON block and contain the required collapsed guidance and metadata.

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR updates several agentic workflow prompts and regenerated lockfiles to stop using agent-authored HTML comments (<!-- ... -->) as persisted markers (since safe-output sanitization strips them), replacing them with either safe-outputs.data structured identifiers or stable visible Markdown fields.

Changes:

• Introduces safe-outputs.data schemas and corresponding prompt guidance for workflows that need machine-readable identity/deduplication.
• Updates the shared KBE templates and eval specs to use collapsed <details> blocks for authoring guidance and workflow-owned match-count metadata (while preserving the “exactly one fenced JSON block” KBE constraint).
• Regenerates the affected *.lock.yml workflows to the newer gh-aw compiler/runtime versions.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/shared/create-kbe.instructions.md	Moves KBE guidance + verification metadata into collapsed <details> blocks while keeping exactly one JSON signature block.
.github/workflows/README.md	Documents that safe outputs strip HTML/XML comments and recommends safe-outputs.data or visible fields.
.github/workflows/evals/README.md	Updates eval expectations to require collapsed guidance + metadata blocks.
.github/workflows/evals/ci-failure-scan.eval.yaml	Updates graders to validate the new <details>-based KBE template requirements.
.github/workflows/closed-issue-reference-check.md	Adds safe-outputs.data schema + updates dedup logic to detect prior advisory comments via structured or legacy visible markers.
.github/workflows/ci-failure-scan.md	Updates scanner match-count gating language to require the new collapsed verification block.
.github/workflows/ci-failure-scan.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-scan-feedback.md	Updates feedback workflow prompt to identify artifacts via structured data or legacy visible blocks; stores tracker metadata in visible collapsed block.
.github/workflows/ci-failure-scan-feedback.lock.yml	Regenerated workflow lockfile (compiler/runtime/tooling version and infra script updates).
.github/workflows/ci-failure-fix.md	Adds safe-outputs.data schema + updates prompt guidance for dedup/identity via structured data with legacy fallback.
.github/aw/actions-lock.json	Updates pinned gh-aw setup action entry to v0.83.5 and removes older entries.
.github/agents/agentic-workflows.agent.md	Adds repo guidance explaining sanitization behavior and when to use safe-outputs.data vs visible fields.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/closed-issue-reference-check.md:161

• The structured-data dedup check matches exact substrings like "workflow_artifact": "..." (note the space after :). If the appended JSON is ever minified (e.g., "workflow_artifact":"...") or otherwise formatted differently, this will false-negative and allow duplicate advisory comments. Using a regex (test) that tolerates whitespace makes the dedup more robust.

 data_workflow='"workflow_artifact": "closed-issue-reference-check"'
data_kind='"artifact_kind": "advice"'
legacy_call_id='gh-aw-workflow-call-id: dotnet/runtime/closed-issue-reference-check'
legacy_workflow_id='gh-aw-workflow-id: closed-issue-reference-check'
legacy_agentic_id='workflow_id: closed-issue-reference-check'

.github/agents/agentic-workflows.agent.md:196

• safe-outputs.data appends a fenced Structured data: JSON block to the posted body, but it isn’t necessarily a second JSON block (it’s only “second” if the body already contains one). Rewording this avoids confusing future workflow authors.

`safe-outputs.data` is not available on every output type; notably, `update_issue` cannot attach it. It also appends a second fenced JSON block to the posted body, which is incompatible with formats such as Known Build Error issues that require exactly one fenced JSON block. In those cases, use narrowly formatted visible fields in the body and preserve them on every rewrite.

[vitek-karas]

Fixed the small updates based on the review - this should be final now - @PureWeen or @kotlarmilos could you please re-approve?

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/closed-issue-reference-check.md:164

• marker_present currently downloads all pages of issue comments (gh api --paginate --slurp ...) before checking for structured/legacy advisory markers. This removes the prior early-exit behavior and can significantly increase API usage and runtime for heavily-commented issues (and makes rate-limit/transient failures more likely).

Consider restoring a short-circuiting scan: fetch the newest page first and walk backwards until a match is found, or stream gh api --paginate into jq using first(...)/select(...) so the pipeline can terminate as soon as a matching comment is detected.

 marker_present() {
local num="$1" pages
pages="$(gh api --paginate --slurp "repos/${REPO}/issues/${num}/comments?per_page=100" 2>/dev/null)" || return 2
jq -e \