Prevent `GH_AW_TOOLS_META_JSON` expression-size overflows in compiled workflows by Copilot · Pull Request #53965 · github/gh-aw

Copilot · 2026-08-19T10:33:20Z

The daily compatibility audit surfaced a compiler-side regression: large, compiler-generated GH_AW_TOOLS_META_JSON blocks could fail compilation when they contained ${{ }} expressions and crossed GitHub Actions’ 21KB expression-bearing limit. This failure mode affected otherwise valid workflows with large tool metadata.

Compiler path: sanitize tools-meta expression payload
- In pkg/workflow/mcp_setup_safe_outputs.go, added tools-meta runtime data preparation that:
  - detects ${{ ... }} in generated tools meta JSON,
  - rewrites them to ${GH_AW_*} placeholders in the emitted YAML block scalar,
  - emits corresponding step env bindings so values can be restored at runtime.
- This removes raw template expressions from the large YAML value while preserving semantics.
Runtime path: resolve placeholders before materializing tools_meta.json
- In actions/setup/js/generate_safe_outputs_tools.cjs, added placeholder resolution for GH_AW_TOOLS_META_JSON prior to writing tools_meta.json.
- Runtime behavior stays consistent; only transport/encoding of expression-bearing content changes.
Regression coverage
- Added targeted tests for:
  - Go-side tools-meta expression extraction/sanitization,
  - JS-side placeholder resolution when GH_AW_TOOLS_META_JSON is provided via env.

sanitized, envKeys, envValues:=buildToolsMetaRuntimeData(toolsMetaJSON)
// sanitized: ... "${GH_AW_*}" ...// envValues: GH_AW_* -> "${{ ... }}"

Fixes[aw-compat] Daily AW compat audit (2026-08-19): 8/20 repos fail after fix, gh search code unavailable #53949

Generated by PR Sous Chef run https://github.com/github/gh-aw/actions/runs/32249206937> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.7 AIC · ⌖ 8.26 AIC · ⊞ 9.3K · ◷

_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-19T10:54:15Z

@copilot add tests

Copilot

Pull request overview

Prevents oversized expression-bearing tools metadata from exceeding GitHub Actions limits.

Changes:

Replaces embedded expressions with runtime environment placeholders.
Resolves placeholders before generating tools metadata.
Adds Go and JavaScript regression tests.

Show a summary per file

File	Description
`pkg/workflow/mcp_setup_safe_outputs.go`	Sanitizes tools metadata expressions.
`pkg/workflow/mcp_setup_safe_outputs_test.go`	Tests expression extraction.
`actions/setup/js/generate_safe_outputs_tools.cjs`	Restores runtime placeholders.
`actions/setup/js/generate_safe_outputs_tools.test.cjs`	Tests placeholder resolution.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-08-19T19:59:00Z

+ * @returns {string}
+ */
+function resolveEnvStringPlaceholders(value) {
+ return value.replace(/\$\{([A-Z_][A-Z0-9_]*)\}/g, (match, envName) => process.env[envName] ?? match);


Fixed in e403f67: resolveEnvStringPlaceholders now JSON-escapes the resolved env value (JSON.stringify(value).slice(1, -1)) before splicing it into the JSON text, so quotes/backslashes/newlines in the resolved value no longer corrupt tools_meta.json. Added regression tests covering these characters.

Copilot · 2026-08-19T19:59:05Z

+	sanitizedToolsMeta := toolsMetaJSON
+	for _, expr := range sliceutil.SortedKeys(expressionEnvVars) {
+ envName := expressionEnvVars[expr]
+ envValues[envName] = expr


Fixed in e403f67: buildToolsMetaRuntimeData now decodes the matched JSON string fragment via decodeJSONStringFragment (reversing encoding/json's HTML-escaping of <, >, &) before storing it as the step env value, while still replacing the encoded form in sanitizedToolsMeta. Added TestBuildToolsMetaRuntimeDataDecodesHTMLEscapedExpression to cover this.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-19T11:08:49Z

@copilot add tests

Added tests in 3e2b5f6 (approx, see latest commit): Go tests for buildToolsMetaRuntimeData covering multiple distinct expressions and deduped repeated expressions, plus JS tests for GH_AW_TOOLS_META_JSON covering multiple placeholders and unresolved placeholders.

@copilot add tests

Added tests in 8b6b0ba: Go tests for buildToolsMetaRuntimeData covering multiple distinct expressions and deduped repeated expressions, plus JS tests for GH_AW_TOOLS_META_JSON covering multiple placeholders and unresolved placeholders.

gh-aw-bot · 2026-08-19T11:53:06Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.

Failed checks to revisit after your update:
- lint-js — https://github.com/github/gh-aw/actions/runs/32246157384/job/96051212369
Please refresh the branch if needed.
Then run the pr-finisher skill before handing back for maintainer review.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.7 AIC · ⌖ 8.26 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

gh-aw-bot · 2026-08-19T12:05:08Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.

There are unresolved review comments about JSON-safe placeholder substitution in generate_safe_outputs_tools.cjs and encoded expression restoration in buildToolsMetaRuntimeData; please fix both and reply on-thread.
Please refresh the branch if needed after the fixes land.
Then run the pr-finisher skill before handing back for maintainer review.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14 AIC · ⌖ 8.19 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-19T12:15:17Z

@copilot Please address the remaining maintainer-visible blockers on this PR in one pass.
There are unresolved review comments about JSON-safe placeholder substitution in `generate_safe_outputs_too...

Fixed both in e403f67:

generate_safe_outputs_tools.cjs: resolveEnvStringPlaceholders now JSON-escapes the resolved env value (via JSON.stringify(...).slice(1,-1)) before splicing it into the JSON text, so quotes/backslashes/newlines in the value no longer corrupt tools_meta.json.
mcp_setup_safe_outputs.go: buildToolsMetaRuntimeData now decodes the matched JSON string fragment (reversing encoding/json's HTML-escaping of <, >, &, etc.) before storing it as the step env value, while still replacing the encoded form in sanitizedToolsMeta.

Added regression tests for both.

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-08-19T12:26:27Z

PR Triage

Category: bug
Risk: high
Priority score: 74/100 (impact 40 + urgency 22 + quality 12)
Recommended action: fast_track

Compiler fix: prevents GH_AW_TOOLS_META_JSON from exceeding GitHub Actions 21KB expression limit, a real compile-blocking regression.

Generated by 🔧 PR Triage Agent · auto · 44.3 AIC · ⌖ 2.78 AIC · ⊞ 8.3K · ◷

gh-aw-bot · 2026-08-19T13:08:27Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please refresh the branch if needed.
Then run the pr-finisher skill and leave a concise maintainer-visible handoff comment with validation and any remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.53 AIC · ⌖ 8.14 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T13:19:05Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.
Please refresh the branch if needed....

Verified the branch is up to date and both prior review threads (JSON-safe placeholder escaping in generate_safe_outputs_tools.cjs, HTML-escape decoding in buildToolsMetaRuntimeData) are already fixed in e403f67/900b17f, with regression tests passing locally.

Local validation on HEAD (900b17f):

make fmt — clean, no diff.
make lint — 0 errors; only pre-existing warnings and one pre-existing testifylint failure in pkg/intent/governance_formal_test.go (untouched by this PR, last modified in [docs] Update glossary - daily scan #53961).
Go tests: TestBuildToolsMetaRuntimeData* (5 cases) pass.
JS tests: generate_safe_outputs_tools.test.cjs (32 cases) pass, including prettier formatting check.
make recompile — no diff, all 286 workflows compile clean.
go build ./... — clean.

I can't resolve the two GitHub review-thread conversations from this environment (no thread-resolve capability available to me), but their underlying issues are fixed in code as noted above. CI on this HEAD hasn't re-run since my push and needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a new push) to go green.

Remaining: awaiting maintainer review/approval (mergeable_state is blocked pending requested reviews from @pelikhan and @gh-aw-bot).

github-actions · 2026-08-19T18:30:19Z

PR Triage

Category: bug · Risk: high · Score: 70/100 (impact 35 + urgency 25 + quality 10)
Recommended action:fast_track

Critical compiler correctness fix (expression-size overflow) with CI green; review history has churn (dismissed review) — highest score, needs prompt human attention.

Automated triage — see run report for full details.

Generated by 🔧 PR Triage Agent · auto · 90.2 AIC · ⌖ 2.82 AIC · ⊞ 8.3K · ◷

gh-aw-bot · 2026-08-19T19:54:15Z

@copilot This PR looks close, but it still still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:

Resolve or answer any remaining unresolved review thread(s) directly on-thread.
Refresh the branch if GitHub offers one.
Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment with validation and remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 31.4 AIC · ⌖ 8.18 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T19:59:25Z

@copilot This PR looks close, but it still still needs a maintainer-facing finish pass.
Please do one final forward-progress sweep:...

Replied on-thread to both previously unresolved review comments (r3812371390, r3812371435) confirming the fixes landed in e403f67, with commit references and test names. I don't have a thread-resolve capability in this environment, so the threads remain open pending a maintainer/reviewer marking them resolved.

Branch base is unchanged (still on main@4bb738f) — no refresh needed, not behind.

Local validation on HEAD (900b17f), re-verified:

make fmt — clean, no diff.
make lint — 0 errors; only pre-existing warnings plus one pre-existing testifylint failure in pkg/intent/governance_formal_test.go (unrelated, last touched by [docs] Update glossary - daily scan #53961).
Go tests TestBuildToolsMetaRuntimeData* (5 cases) — pass.
JS tests generate_safe_outputs_tools.test.cjs (32 cases) — pass, prettier clean.
make recompile — no diff, 286/286 workflows compile clean.
go build ./... — clean.

Remaining risk/blocker: mergeable_state is blocked pending requested reviews from @pelikhan and @gh-aw-bot — not actionable from this environment. CI on this HEAD is stale since my last push and needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a new push).

gh-aw-bot · 2026-08-19T20:59:46Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.

Please do one final forward-progress sweep:

Resolve or answer the remaining unresolved review threads directly on-thread.
Refresh the branch if GitHub offers one.
Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment with validation and remaining risks.

Open review threads (newest first):

Copilot: decode HTML-escaped JSON string fragments before re-emitting GitHub Actions expressions — Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflows #53965 (comment)
Copilot: JSON-escape env placeholder substitutions before splicing into serialized tools metadata — Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflows #53965 (comment)

If both are already fixed on the current head, reply on-thread with the exact commit/test evidence so reviewers can resolve them quickly.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 19.9 AIC · ⌖ 8.28 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-19T21:04:24Z

@copilot This PR looks close, but it still needs a maintainer-facing finish pass.
Please do one final forward-progress sweep:...

Both threads already have on-thread replies with commit/test evidence from the prior pass: r3816286526 and r3816287113. No code changed since then; HEAD is still 900b17f, branch is not behind main, and local validation (fmt/lint/tests/recompile/build) remains green as previously reported. Resolving the threads requires maintainer/reviewer action, which I can't do from this environment.

github-actions · 2026-08-20T22:03:21Z

🎉 This pull request is included in a new release.

Release: v0.87.2

Initial plan
e83a799

CopilotAI assigned Copilot and pelikhan Aug 19, 2026

Copilotstarted work on behalf of pelikhan August 19, 2026 10:33 View session

CopilotAI linked an issue Aug 19, 2026 that may be closed by this pull request
[aw-compat] Daily AW compat audit (2026-08-19): 8/20 repos fail after fix, gh search code unavailable #53949
Closed

CopilotAIand others added 2 commits August 19, 2026 10:45

Avoid oversized expression-bearing tools meta block
dda8f8b
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Handle tools-meta expressions via runtime placeholders
b4510fa
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Audit daily compatibility for AW with repositories~~Prevent GH_AW_TOOLS_META_JSON expression-size overflows in compiled workflowsAug 19, 2026

Copilotfinished work on behalf of pelikhan August 19, 2026 10:51

CopilotAI requested a review from pelikhan August 19, 2026 10:51

pelikhan marked this pull request as ready for review August 19, 2026 10:54

CopilotAI balanced review requested due to automatic review settings August 19, 2026 10:54

Copilotstarted reviewing on behalf of pelikhan August 19, 2026 10:54 View session

CopilotAI reviewed Aug 19, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan August 19, 2026 11:02 View session

github-actionsBot mentioned this pull request Aug 19, 2026
[pr-sous-chef] pr-sous-chef run report #53885
Closed

Add regression tests for tools-meta placeholder handling
8b6b0ba
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan August 19, 2026 11:09

Merge branch 'main' into copilot/aw-compat-daily-audit
94d1f04

Copilotstarted work on behalf of gh-aw-bot August 19, 2026 11:53 View session

Fix prettier formatting in eslint-factory test file
ff5bae3
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilotfinished work on behalf of gh-aw-bot August 19, 2026 12:02

CopilotAI requested a review from gh-aw-bot August 19, 2026 12:02

Copilotstarted work on behalf of gh-aw-bot August 19, 2026 12:05 View session

Fix JSON-safe placeholder resolution and expression decoding
e403f67
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Document invariant for decodeJSONStringFragment
900b17f
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilotfinished work on behalf of gh-aw-bot August 19, 2026 12:17

github-actionsBot added pr-action:fast_track pr-agent:copilot pr-priority:high pr-risk:high pr-type:bug labels Aug 19, 2026

github-actionsBot mentioned this pull request Aug 19, 2026
[PR Triage Report] PR Triage Report — 2026-08-19 (Run 32251836165) #53992
Closed

Copilotstarted work on behalf of gh-aw-bot August 19, 2026 13:09 View session

Copilotfinished work on behalf of gh-aw-bot August 19, 2026 13:19

github-actionsBot mentioned this pull request Aug 19, 2026
[PR Triage Report] PR Triage Report — 2026-08-19 (Run 32286379053) #54060
Closed

Copilotstarted work on behalf of gh-aw-bot August 19, 2026 19:54 View session

Copilotfinished work on behalf of gh-aw-bot August 19, 2026 19:59

Copilotstarted work on behalf of gh-aw-bot August 19, 2026 21:00 View session

Copilotfinished work on behalf of gh-aw-bot August 19, 2026 21:04

pelikhan merged commit bece4a9 into mainAug 20, 2026
40 checks passed

pelikhan deleted the copilot/aw-compat-daily-audit branch August 20, 2026 00:03

github-actionsBot mentioned this pull request Aug 20, 2026
Smoke Test: MAI-Code-1-Flash - 32375451921 #54247
Closed

Uh oh!

Conversation

CopilotAI commented Aug 19, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Aug 19, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

CopilotAIAug 19, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIAug 19, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI commented Aug 19, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

CopilotAI commented Aug 19, 2026

Uh oh!

github-actionsBot commented Aug 19, 2026

PR Triage

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

CopilotAI commented Aug 19, 2026

Uh oh!

github-actionsBot commented Aug 19, 2026

PR Triage

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

CopilotAI commented Aug 19, 2026

Uh oh!

gh-aw-bot commented Aug 19, 2026

Uh oh!

CopilotAI commented Aug 19, 2026

Uh oh!

Uh oh!

github-actionsBot commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CopilotAI commented Aug 19, 2026•
edited by github-actions Bot
Loading

CopilotAI commented Aug 19, 2026•
edited
Loading