Uh oh!
There was an error while loading. Please reload this page.
Enable external threat detection by default - #54111
Merged
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilotcreated this pull request from a session on behalf of pelikhanAugust 20, 2026 01:06 View session
pelikhan
commented
Aug 20, 2026
Collaborator
@copilot pin gh-aw-detection to https://github.com/github/gh-aw-threat-detection/releases/tag/v0.4.11 and going forward add it to the list of dependencies that get upgraded by the cli dependency updater agentic workflow. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Excellent work on this threat detection refactor! 🎯 This PR successfully transitions the default threat detection behavior to use the external threat-detect binary while preserving backward compatibility with a feature flag. The implementation is well-structured and includes: ✅ Comprehensive documentation — Feature flag behavior is clearly documented in The scope is appropriately focused on this single concern (threat detection default), and the PR has a clear, actionable description. As this is marked as a draft, it looks ready for team review when you're ready to move it forward. Great contribution to the codebase!
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
ContributorAuthor
Pinned |
Contributor
There was a problem hiding this comment.
Pull request overview
Makes external threat detection the default while retaining gh-aw-detection: false for legacy inline detection.
Changes:
- Defaults detection to the external implementation and updates tests.
- Pins
threat-detectto v0.4.11 and regenerates workflows. - Updates feature, artifact, and version-monitoring documentation.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/threat_detection_test.go | Opts inline-path tests out. |
pkg/workflow/threat_detection_isolation_test.go | Preserves inline isolation fixtures. |
pkg/workflow/threat_detection_file_access_test.go | Preserves inline file-access tests. |
pkg/workflow/features.go | Enables external detection by default. |
pkg/workflow/features_test.go | Tests default and opt-out behavior. |
pkg/workflow/detection_success_test.go | Keeps legacy success fixture inline. |
pkg/workflow/compiler_validators.go | Suppresses warnings for implicit defaults. |
pkg/constants/version_constants.go | Pins detector v0.4.11. |
pkg/constants/README.md | Documents the new default. |
pkg/constants/feature_constants.go | Updates flag documentation. |
pkg/constants/constants.go | Updates result-path documentation. |
docs/src/content/docs/reference/threat-detection.md | Explains implementation selection. |
docs/src/content/docs/reference/feature-flags.md | Documents the opt-out flag. |
docs/src/content/docs/reference/artifacts.md | Updates detection artifact guidance. |
.github/workflows/typist.lock.yml | Pins detector v0.4.11. |
.github/workflows/tidy.lock.yml | Regenerates external detection steps. |
.github/workflows/test-quality-sentinel.lock.yml | Pins detector v0.4.11. |
.github/workflows/technical-doc-writer.lock.yml | Regenerates external detection steps. |
.github/workflows/static-analysis-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/smoke-gemini.lock.yml | Regenerates external detection steps. |
.github/workflows/refiner.lock.yml | Regenerates external detection steps. |
.github/workflows/q.lock.yml | Pins detector v0.4.11. |
.github/workflows/prompt-clustering-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/pr-sous-chef.lock.yml | Pins detector v0.4.11. |
.github/workflows/pr-description-caveman.lock.yml | Pins detector v0.4.11. |
.github/workflows/pr-code-quality-reviewer.lock.yml | Pins detector v0.4.11. |
.github/workflows/ponytail-reviewer.lock.yml | Pins detector v0.4.11. |
.github/workflows/mcp-inspector.lock.yml | Pins detector v0.4.11. |
.github/workflows/mattpocock-skills-reviewer.lock.yml | Pins detector v0.4.11. |
.github/workflows/issue-triage-agent.lock.yml | Regenerates external detection steps. |
.github/workflows/issue-monster.lock.yml | Pins detector v0.4.11. |
.github/workflows/impeccable-skills-reviewer.lock.yml | Pins detector v0.4.11. |
.github/workflows/go-pattern-detector.lock.yml | Pins detector v0.4.11. |
.github/workflows/github-remote-mcp-auth-test.lock.yml | Pins detector v0.4.11. |
.github/workflows/github-mcp-structural-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/example-workflow-analyzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/eslint-monster.lock.yml | Pins detector v0.4.11. |
.github/workflows/duplicate-code-detector.lock.yml | Pins detector v0.4.11. |
.github/workflows/docs-noob-tester.lock.yml | Pins detector v0.4.11. |
.github/workflows/dev-hawk.lock.yml | Pins detector v0.4.11. |
.github/workflows/detection-analysis-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/designer-drift-audit.lock.yml | Pins detector v0.4.11. |
.github/workflows/design-decision-gate.lock.yml | Pins detector v0.4.11. |
.github/workflows/deployment-incident-monitor.lock.yml | Pins detector v0.4.11. |
.github/workflows/dependabot-go-checker.lock.yml | Pins detector v0.4.11. |
.github/workflows/dependabot-burner.lock.yml | Pins detector v0.4.11. |
.github/workflows/delight.lock.yml | Pins detector v0.4.11. |
.github/workflows/deepsec-security-scan.lock.yml | Pins detector v0.4.11. |
.github/workflows/deep-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/dataflow-pr-discussion-dataset.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-yamllint-fixer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-workflow-updater.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-windows-terminal-integration-builder.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-vulnhunter-scan.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-token-consumption-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-testify-uber-super-expert.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-team-evolution-insights.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-syntax-error-quality.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-squid-image-scan.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-spending-forecast.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-spec-coverage-kiro.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-spdd-spec-planner.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-semgrep-scan.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-security-red-team.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-security-observability.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-schema-audit-cursor.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-safeoutputs-git-simulator.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-safe-outputs-conformance.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-safe-output-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-safe-output-integrator.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-repo-chronicle.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-rendering-scripts-verifier.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-reliability-review.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-regulatory.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-regression-audit-kiro.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-pr-review-cursor.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-performance-summary.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-observability-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-news.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-multi-device-docs-tester.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-model-resolution.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-model-inventory.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-mcp-concurrency-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-max-ai-credits-test.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-issues-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-hippo-learn.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-graft-intelligence.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-go-test-stubs-aider.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-go-test-parallelizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-geo-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-function-namer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-formal-spec-verifier.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-firewall-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-file-diet.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-fact.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-experiment-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-evals-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-elixir-credo-snippet-audit.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-doc-updater.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-doc-healer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-credit-limit-test.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-compiler-quality.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-community-attribution.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-code-metrics.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-code-debt-aider.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-cli-tools-tester.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-cli-performance.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-choice-test.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-caveman-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-cache-strategy-analyzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-byok-ollama-test.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-assign-issue-to-user.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-arxiv-researcher.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-architecture-diagram.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-ambient-context-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-agentrx-trace-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml | Pins detector v0.4.11. |
.github/workflows/daily-action-setup-security-audit.lock.yml | Pins detector v0.4.11. |
.github/workflows/craft.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-session-insights.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-pr-prompt-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-pr-nlp-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-pr-merged-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-opt.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-cli-deep-research.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-centralization-optimizer.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-centralization-drilldown.lock.yml | Pins detector v0.4.11. |
.github/workflows/copilot-agent-analysis.lock.yml | Pins detector v0.4.11. |
.github/workflows/contribution-check.lock.yml | Pins detector v0.4.11. |
.github/workflows/constraint-solving-potd.lock.yml | Pins detector v0.4.11. |
.github/workflows/commit-changes-analyzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/code-scanning-fixer.lock.yml | Pins detector v0.4.11. |
.github/workflows/cloclo.lock.yml | Pins detector v0.4.11. |
.github/workflows/cli-version-checker.md | Adds detector release monitoring. |
.github/workflows/cli-version-checker.lock.yml | Regenerates version-checker workflow. |
.github/workflows/cli-consistency-checker.lock.yml | Pins detector v0.4.11. |
.github/workflows/claude-code-user-docs-review.lock.yml | Pins detector v0.4.11. |
.github/workflows/ci-doctor.lock.yml | Pins detector v0.4.11. |
.github/workflows/ci-coach.lock.yml | Pins detector v0.4.11. |
.github/workflows/chaos-pr-bundle-fuzzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/changeset.lock.yml | Pins detector v0.4.11. |
.github/workflows/breaking-change-checker.lock.yml | Pins detector v0.4.11. |
.github/workflows/blog-auditor.lock.yml | Pins detector v0.4.11. |
.github/workflows/aw-failure-investigator.lock.yml | Pins detector v0.4.11. |
.github/workflows/avenger.lock.yml | Pins detector v0.4.11. |
.github/workflows/auto-triage-issues.lock.yml | Pins detector v0.4.11. |
.github/workflows/audit-workflows.lock.yml | Pins detector v0.4.11. |
.github/workflows/artifacts-summary.lock.yml | Pins detector v0.4.11. |
.github/workflows/archivx-agentic-workflows-analyzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/architecture-guardian.lock.yml | Pins detector v0.4.11. |
.github/workflows/archie.lock.yml | Pins detector v0.4.11. |
.github/workflows/approach-validator.lock.yml | Pins detector v0.4.11. |
.github/workflows/api-consumption-report.lock.yml | Pins detector v0.4.11. |
.github/workflows/agentic-token-trend-audit.lock.yml | Pins detector v0.4.11. |
.github/workflows/agent-persona-explorer.lock.yml | Pins detector v0.4.11. |
.github/workflows/agent-performance-analyzer.lock.yml | Pins detector v0.4.11. |
.github/workflows/agent-job-health.lock.yml | Pins detector v0.4.11. |
.github/workflows/ab-testing-advisor.lock.yml | Pins detector v0.4.11. |
.github/skills/agentic-workflows/SKILL.md | Adds job guidance to workflow routing. |
Review details
- Files reviewed: 170/252 changed files
- Comments generated: 2
- Review effort level: Balanced
| if isFeatureInEnvironment(flagLower, logEnabled) { | ||
| return true | ||
| } | ||
| return true |
| @@ -14,7 +14,7 @@ GitHub Agentic Workflows upload several artifacts during workflow execution. Thi | |||
| | `agent` | `constants.AgentArtifactName`<br/>Source: `pkg/constants/job_constants.go` | Multi-file | Unified agent job outputs (logs, safe outputs, token usage summary) | | |||
| | `activation` | `constants.ActivationArtifactName` | Multi-file | Activation job output (`aw_info.json`, `prompt.txt`, rate limits) | | |||
| | `firewall-audit-logs` | `constants.FirewallAuditArtifactName`<br/>Source: `pkg/constants/constants.go` | Multi-file | AWF firewall audit/observability logs (token usage, network policy, audit trail) | | |||
| | `detection` | `constants.DetectionArtifactName` | Conditional | Inline engine: single-file `detection.log`. External `gh-aw-detection` engine (`features: gh-aw-detection: true`): multi-file `detection_result.json` + `step-summary.md`; `detection.log` is intentionally **not** uploaded (see below) | | |||
| | `detection` | `constants.DetectionArtifactName` | Conditional | Legacy inline engine (`features.gh-aw-detection: false`): single-file `detection.log`. The default external `gh-aw-detection` engine: multi-file `detection_result.json` + `step-summary.md`; `detection.log` is intentionally **not** uploaded (see below) | | |||
This was referenced Aug 20, 2026
Contributor
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gh-aw-detectionshould default to the external threat-detection implementation while retaining a feature flag for legacy behavior.threat-detectexecution when the flag is omitted.falseas the legacy inline detection path.