Skip to content

Refresh aw.yml package dependencies during update - #53974

Merged
pelikhan merged 5 commits into
mainfrom
copilot/fix-stale-shared-dependencies
Aug 20, 2026
Merged

Refresh aw.yml package dependencies during update#53974
pelikhan merged 5 commits into
mainfrom
copilot/fix-stale-shared-dependencies

Conversation

CopilotAI commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

gh aw update refreshed package workflow entry points but left package-owned shared dependencies stale. Compiled workflows could therefore continue using outdated imported files.

  • Dependency refresh

    • Fetch the complete dependency closure from the selected package revision.
    • Overwrite package-owned imports, includes, runtime imports, workers, and resources.
    • Apply the same behavior to newly introduced package workflows.
  • Regression coverage

    • Verify stale direct and transitive shared imports are updated.
    • Verify dependencies of newly added workflows are installed.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 8.21 AIC · ⊞ 9.3K ·
Comment /souschef to run again

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
CopilotAI changed the title [WIP] Fix stale shared package dependencies in gh aw updateRefresh aw.yml package dependencies during updateAug 19, 2026
CopilotAI requested a review from pelikhanAugust 19, 2026 11:54
@pelikhan
pelikhan marked this pull request as ready for review August 19, 2026 11:56
CopilotAI balanced review requested due to automatic review settings August 19, 2026 11:56
@github-actions

github-actionsBot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

@github-actions

github-actionsBot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #53974 does not have the implementation label and has 67 new lines of code in business logic directories, which is below the 100-line threshold.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

@github-actions

github-actionsBot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

@github-actions

github-actionsBot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Ponytail Reviewer completed successfully!

Ponytail over-engineering review of PR #53974: the diff adds a single thin wrapper (fetchManifestManagedDependencies) used at two call sites to avoid duplicating WorkflowSpec construction before calling the existing fetchAllRemoteDependencies. No dead code, speculative abstractions, reinvented stdlib, or unneeded dependencies found; test additions are proportionate to the new behavior. Lean already. Ship.

Generated by Ponytail Reviewer for #53974

@github-actions

github-actionsBot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

@github-actions

Copy link
Copy Markdown
Contributor

Comment Memory

reviewed_at: 2026-08-19T00:00:00Z
review_event: COMMENT
top_themes:
- dependency refresh path looks covered
- no changed-line blocking issues found
files_reviewed:
- pkg/cli/update_manifest.go
- pkg/cli/update_manifest_test.go
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 6.33 AIC · ⌖ 6.81 AIC · ⊞ 7K ·
Comment /review to run again

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict

COMMENT — I did not find a changed-line bug severe enough to block this PR.

Highlights
  • The new dependency refresh hook is wired into both update and add paths.
  • The regression test exercises stale direct and transitive shared imports plus installation for a newly added workflow.
  • I did not find a duplicated existing review comment to add, and there were no actionable blocking findings from my pass.

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 6.33 AIC · ⌖ 6.81 AIC · ⊞ 7K
Comment /review to run again

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change correctly wires dependency fetching into both the update and add paths for manifest-managed workflows. Test coverage is solid — it validates transitive imports and the new-workflow case.

One minor observation (non-blocking): fetchManifestManagedDependencies is called before the "already up-to-date" early-return check (line 218 vs line 222), so dependencies are always re-downloaded even for no-op runs. Consider moving the dependency fetch after the early-return guard to avoid redundant network calls when nothing has changed.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 18.3 AIC · ⌖ 8.8 AIC · ⊞ 5.7K

@github-actionsgithub-actionsBot mentioned this pull request Aug 19, 2026

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Refreshes package-managed workflow dependencies during gh aw update, including dependencies for newly added workflows.

Changes:

  • Fetches and overwrites complete remote dependency closures.
  • Adds regression coverage for direct, transitive, and new-workflow imports.
Show a summary per file
FileDescription
pkg/cli/update_manifest.goRefreshes dependencies during package workflow updates and additions.
pkg/cli/update_manifest_test.goTests stale and newly introduced dependency refreshes.

Review details

Suppressed comments (2)

pkg/cli/update_manifest.go:218

  • Dependencies may be changed here even when the package ref, path, and workflow entry point are unchanged. The fast path immediately below then returns without recompiling, so a branch update that only changes a shared dependency leaves the existing .lock.yml embedding stale content. Recompile after refreshing dependencies before taking that return path.
	if err := fetchManifestManagedDependencies(ctx, newContent, update.repo, update.latestPath, update.latestRef, filepath.Dir(update.wf.Path), opts.Verbose); err != nil {

pkg/cli/update_manifest.go:340

  • This dependency fetch runs after the new workflow has already been written. If a fatal dispatch, worker, or resource dependency error occurs, the operation is reported as failed but <name>.md remains installed. Fetch before writing the entry point (as the regular add path does), or track and roll back all writes on failure.
	if err := fetchManifestManagedDependencies(ctx, newContent, repo, latestPath, latestRef, targetDir, opts.Verbose); err != nil {
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment threadpkg/cli/update_manifest.go Outdated
},
WorkflowPath: workflowPath,
}
return fetchAllRemoteDependencies(ctx, string(content), spec, targetDir, verbose, true, nil)

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skills-Based Review 🧠

Applied /diagnosing-bugs — the fix and its regression tests are solid; two ordering/consistency observations worth addressing before merge.

📋 Key Themes & Highlights

Key Themes

  • Eager dependency fetch: fetchManifestManagedDependencies runs before the "already up to date" guard in updateManifestManagedWorkflow, performing unnecessary network I/O on no-op updates.
  • Content variable inconsistency: addManifestManagedWorkflow passes newContent (raw download) to fetchManifestManagedDependencies while the frontmatter-modified content is what gets written to disk.

Positive Highlights

  • ✅ Clean, well-scoped helper function fetchManifestManagedDependencies that delegates to fetchAllRemoteDependencies.
  • ✅ Good regression tests covering stale direct imports, transitive imports, and newly added workflow dependencies.
  • ✅ Proper save/restore of the downloadRemoteImportFile function var in test cleanup.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 26.8 AIC · ⌖ 10 AIC · ⊞ 7.8K
Comment /matt to run again

Comment threadpkg/cli/update_manifest.go Outdated
if err != nil {
return fmt.Errorf("failed to download workflow %s/%s@%s: %w", update.repo, update.latestPath, update.latestRef, err)
}
if err := fetchManifestManagedDependencies(ctx, newContent, update.repo, update.latestPath, update.latestRef, filepath.Dir(update.wf.Path), opts.Verbose); err != nil {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] Dependencies are fetched before the "already up to date" early-return check (line 222), so every gh aw update run downloads the full dependency closure even when nothing changed — wasting network I/O and risking overwriting local modifications with no-op updates.

💡 Suggested fix

Move fetchManifestManagedDependencies to after the early-return guard so it only runs when an actual update is going to be applied:

if!opts.Force&&update.currentRef==update.latestRef&&... {
// ... up-to-date check ...returnnil
}
// Only fetch dependencies when an update is actually written.iferr:=fetchManifestManagedDependencies(...); err!=nil { ... }

@copilot please address this.

Comment threadpkg/cli/update_manifest.go Outdated
if err := os.WriteFile(destPath, []byte(content), constants.FilePermPublic); err != nil {
return fmt.Errorf("failed to write new manifest workflow %s: %w", destPath, err)
}
if err := fetchManifestManagedDependencies(ctx, newContent, repo, latestPath, latestRef, targetDir, opts.Verbose); err != nil {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] In addManifestManagedWorkflow, fetchManifestManagedDependencies is called with newContent (the raw downloaded bytes) rather than content (the frontmatter-modified string written to disk). If fetchAllRemoteDependencies resolves import paths relative to the workflow content it parses, using the pre-modification bytes is consistent — but if it differs, this is a latent bug. Consider using the same content variable that was written to disk for correctness and consistency.

@copilot please address this.

@github-actions

Copy link
Copy Markdown
Contributor

PR Triage

  • Category: bug
  • Risk: medium
  • Priority score: 58/100 (impact 28 + urgency 18 + quality 12)
  • Recommended action: fast_track

Fixes gh aw update leaving package-owned shared dependencies stale by refreshing the full dependency closure.

Generated by 🔧 PR Triage Agent · auto · 44.3 AIC · ⌖ 2.78 AIC · ⊞ 8.3K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot This PR still needs a maintainer-facing finish pass.

  • Please address the remaining reviewer observations about dependency-refresh ordering/consistency in pkg/cli/update_manifest.go (notably the early-return/recompile path and add-path fetch ordering/content consistency), or reply on-thread if they are intentionally out of scope.
  • Refresh the branch if needed.
  • Then run the pr-finisher skill and leave a concise maintainer-visible handoff comment with validation and any remaining risks.

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.19 AIC · ⌖ 8.06 AIC · ⊞ 9.3K ·
Comment /souschef to run again

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

CopilotAI commented Aug 19, 2026

Copy link
Copy Markdown
ContributorAuthor

@copilot This PR still needs a maintainer-facing finish pass.

  • Please address the remaining reviewer observations about dependency-refresh ordering/consistency in pkg/cli/update_manifest.go (notab...

Addressed in 08fa5a5: manifest dependency refresh now runs only after the no-op guard, and added workflows parse the finalized content. Added regression coverage for unchanged workflows. Focused test, build, Go lint, and impacted Go tests pass; automated review found no findings. make agent-report-progress is otherwise blocked by missing sandbox Node typings/vitest. CodeQL reported no alerts but skipped analysis because the database is too large. CI on this pushed head needs a maintainer re-trigger.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot This PR looks close, but it still needs one maintainer-facing finish pass.

  • Please refresh the branch if GitHub still offers one.
  • There may still be unresolved reviewer observations about dependency-refresh ordering/consistency in pkg/cli/update_manifest.go; reply on-thread if all current-head concerns are already addressed.
  • Then run the pr-finisher skill and leave a concise maintainer-facing handoff comment with validation and any remaining merge risks.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⌖ 8.21 AIC · ⊞ 9.3K ·
Comment /souschef to run again

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

CopilotAI commented Aug 19, 2026

Copy link
Copy Markdown
ContributorAuthor

@copilot This PR looks close, but it still needs one maintainer-facing finish pass.

  • Please refresh the branch if GitHub still offers one....

4c50f54 addresses the remaining dependency-refresh concerns: manifest refresh now propagates include/import/runtime failures, and new workflow dependencies are fetched before the entry point is written. The branch includes current main.

Validation: focused regression test, make fmt, make test, make recompile, and make agent-report-progress passed. make lint still reports three pre-existing pkg/intent/governance_formal_test.go testifylint findings. CodeQL found no alerts but skipped analysis because its database is too large. CI on this agent-pushed head is unverified and requires a maintainer re-trigger before merge.

@github-actions

Copy link
Copy Markdown
Contributor

PR Triage

Category: chore · Risk: medium · Score: 58/100 (impact 25 + urgency 15 + quality 18)
Recommended action:fast_track

Dependency freshness fix, approved review, moderate footprint; good fast-track candidate pending CI.

Automated triage — see run report for full details.

Generated by 🔧 PR Triage Agent · auto · 90.2 AIC · ⌖ 2.82 AIC · ⊞ 8.3K ·

@pelikhan
pelikhan merged commit b88cb86 into mainAug 20, 2026
28 checks passed
@pelikhan
pelikhan deleted the copilot/fix-stale-shared-dependencies branch August 20, 2026 00:03
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.87.2

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

gh aw update leaves shared package dependencies stale

4 participants

@gh-aw-bot@pelikhan