925dc83735
Migrate pull request automation away from pull_request_target ( #2625 )
...
* Migrate pull_request_target workflows
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Address PR duplicate check writer review
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Fix duplicate-check writer artifact handling
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Make PR duplicate check gh-aw compilable
Configure the agentic workflow source to allow fork PR triggers with staged safe outputs, upload a PR context artifact through supported post-steps, and have the workflow_run writer consume that context before publishing validated comments. This lets gh-aw regenerate the lockfile without restoring pull_request_target or privileged PR-code execution.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
* Harden workflow-run PR writers
Bind privileged artifact processing to trusted workflow-run PR identity, serialize same-PR writers, and cap aggregate quality comments.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d
2026-08-14 11:22:06 +10:00
43527d1336
chore: bump contributor check AGT to v4.1.0 ( #2484 )
...
Update contributor-check workflow to fetch AGT scripts from v4.1.0.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com >
Copilot-Session: 4b935b0a-90c8-454f-958f-93b468fd4e17
2026-07-30 12:13:36 +10:00
7f19be7380
Fix contributor check gh api marker argument error ( #2151 )
...
* Fix contributor check comment upsert behavior
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Fix contributor check jq marker filtering
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-29 12:23:17 +10:00
13a1dce22e
Fix contributor reputation check comment deduping ( #2150 )
...
* Fix contributor check comment upsert behavior
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-29 11:59:19 +10:00
9aa4f61105
Patching the comment with the check results over creating a new one ( #1637 )
...
* Patching the comment with the check results over creating a new oneAvoids spamming multiple comments
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-05-07 10:02:09 +10:00
3a81b4e57f
Updating the action triggers for more events ( #1636 )
2026-05-07 09:24:12 +10:00
1f96bce626
Updating version ( #1620 )
2026-05-05 13:58:41 +10:00
1b7a70a049
Run contributor checks from AGT scripts ( #1617 )
...
* Run contributor checks from AGT scripts
Fetch the pinned AGT contributor check scripts directly and execute them with Python so the workflow no longer depends on missing console entrypoints from the published package.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* Log contributor check JSON outputs
Dump the raw AGT JSON outputs and stderr logs in the contributor check workflow to make future debugging easier.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-05 11:53:18 +10:00
4577676325
Fix contributor check risk parsing ( #1614 )
...
Normalize AGT risk extraction in the contributor check workflow so missing per-check values do not render as blank or inflate the overall risk.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-05 11:03:48 +10:00
b644d55e12
feat: add PR intent labeling workflow ( #1604 )
...
* feat: label PR intent
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
* need a git repo
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-05-04 16:34:15 +10:00
c02894b9ad
feat(ci): add contributor reputation check workflow ( #1520 )
...
Add automated contributor reputation screening on PR/issue open events
using AGT's pip-installable CLI tools. Detects coordinated inauthentic
contribution patterns (credential laundering, spray-and-pray).
- Installs via pip (pinned to agent-governance-toolkit==3.3.0)
- Uses jq for JSON parsing
- Fails closed: UNKNOWN risk maps to MEDIUM
- Posts risk summary comment on MEDIUM/HIGH with link to workflow run
- Adds needs-review label for maintainer attention
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-05-04 14:16:27 +10:00
Michael Recachinas
Aaron Powell
Imran Siddique