Fix expert reviewer workflow failing with checkout error

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Amaury Levé (Evangelink)]

Summary

Fix the Expert Code Review (on open) agentic workflow that has been failing on every PR since it was created.

Root Cause

The workflow used pull_request_target with checkout: false (required by gh-aw strict mode). However, the gh-aw infrastructure's Checkout PR branch step needs an existing git repository to fetch and switch to the PR branch. With no initial checkout, every run failed with:

fatal: not a git repository (or any of the parent directories): .git

The "successful" runs (#2, #3) were actually dotnet-maestro[bot] PRs that were rejected at the roles check (permission: none doesn't meet [admin, maintainer, write]). The agent job was skipped, masking the checkout bug.

Fix

Switch the trigger from pull_request_target to pull_request:

• The initial Checkout repository step now provides the git repo
• The Checkout PR branch step can fetch/switch to the PR branch
• The gh-aw compiler auto-adds fork safety (head.repo.id == repository_id)
• roles: [admin, maintainer, write] still blocks non-members
• Removed forks: ["*"] (fork PRs from non-members are already blocked by roles)
• Passes gh aw compile --strict with 0 errors, 0 warnings

[Copilot]

Pull request overview

This PR fixes the “Expert Code Review (on open)” agentic workflow so it can successfully fetch/switch to the PR branch by ensuring a git repository is present in the job workspace, and by updating the workflow trigger semantics accordingly.

Changes:

• Switch workflow trigger from pull_request_target to pull_request and remove checkout: false in the source .agent.md.
• Regenerate the compiled .lock.yml to include an initial repository checkout (and related fork-safety gating).
• Add a new agentic-workflows dispatcher agent document under .github/agents.

Show a summary per file

File	Description
.github/workflows/review-on-open.agent.md	Updates trigger and checkout behavior for the “on open” expert reviewer workflow.
.github/workflows/review-on-open.agent.lock.yml	Regenerated lock file reflecting the new trigger plus added checkout/branch-switch prerequisites.
.github/agents/agentic-workflows.agent.md	Adds a dispatcher agent reference for creating/debugging/upgrading gh-aw workflows.

Copilot's findings

Comments suppressed due to low confidence (1)

.github/workflows/review-on-open.agent.lock.yml:846

• Configure Git credentials is duplicated: it runs once before Checkout PR branch and again after Detect Copilot errors, but there are no subsequent steps that invoke git. Consider removing the second copy to reduce workflow complexity and avoid reintroducing credentials into the workspace after the agent run.

 - name: Configure Git credentials
env:
REPO_NAME: ${{ github.repository }}
SERVER_URL: ${{ github.server_url }}
GITHUB_TOKEN: ${{ github.token }}
run: |
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
git config --global am.keepcr true
# Re-authenticate git with GitHub token
SERVER_URL_STRIPPED="${SERVER_URL#https://}"
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
echo "Git configured with standard GitHub Actions identity"

• Files reviewed: 3/3 changed files
• Comments generated: 2