[pull] trunk from cli:trunk by pull[bot] · Pull Request #14 · Moshbbab/cli

pull · 2026-06-01T10:57:31Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

The triager almost never returned High confidence, and when its prose disagreed with a human reviewer it was usually because it had guessed at something it could have read. It named workflow files that do not exist in this repository, and it called a direct `go.mod` requirement indirect. Both mistakes share a cause: the skill never told the agent to look at the PR's own diff or at the checked-out source tree. It had access to both the whole time. So replace inference with five required evidence items - the diff, the dependency's position in the manifest, the repository's actual import surface, CI state, and upstream release evidence - and make High confidence conditional on having gathered them. The old definition of High was unreachable by construction. It asked for the upstream change to be read "end to end" while a separate instruction capped confidence at Medium rather than reading indefinitely, so any non-trivial bump fell through to Medium no matter how clear it was. Redefine High as decision-relevant completeness: a four-release bump that touches nothing this repository imports is High once you have verified that, because reading the rest could not change the answer. Also drop the dedup protocol, which the pre-flight step now performs deterministically, and add an in-repo coherence check for bumps that edit generated files without updating the version each file records - the gh-aw lock files being the case that prompted it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190d246d-0b1f-4ce6-9aa6-dee10d3d4cf8

The evidence rule told the agent that a dependency in the first `require` block is direct. That is a `go mod tidy` formatting convention, not the semantics. What actually marks a requirement indirect is the trailing `// indirect` comment on its own line, and Go's parser reads it that way regardless of block: put a commented and an uncommented require in the same block and `go mod edit -json` still reports Indirect true and false respectively. The two agree in this repository today, so nothing was misclassified. But the rule would break on a reorganised or hand-edited file, and misreporting a direct dependency as indirect is precisely the error the required-evidence section exists to prevent. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190d246d-0b1f-4ce6-9aa6-dee10d3d4cf8

Adding a custom pre-agent `steps:` block made the compiler wrap it in a DIFC proxy, because a guard policy is configured. That proxy applies `min-integrity` but not `trusted-users`, which are resolved at runtime after it starts. The pre-flight finds its dedup marker by reading back its own `cli-triage[bot]` comments, and those are precisely what `min-integrity: approved` filters out - the app posts with author_association NONE, which is why `trusted-users` exists here at all. So the marker was never found, every open Dependabot PR looked unassessed on every run, and the workflow would have re-triaged and re-commented on all of them hourly: the exact failure this design was written to prevent, moved from the agent to a place with no model to notice it. Turning the proxy off does not widen the injection surface. The pre-flight hands nothing it reads to the model - it extracts PR numbers, head SHAs and CI states - and it matches the marker only inside comments already narrowed to the app's own login. That login check, not integrity, is what stops a third party forging a marker. The agent still runs under the full policy via the MCP gateway. Verified against cli/cli: all seven open Dependabot PRs are correctly recognised as already assessed at their current head, and a run with the login filter pointed at a non-existent bot correctly reports them as needing assessment. Three smaller corrections ride along, all fallout from the same review: - Silence no-op issue reporting. gh-aw posts a comment to a shared "no-op runs" issue on every noop, and noop is now the routine idle outcome of an hourly reconciler, so that would have been roughly 24 comments a day forever. The run log already records why a run did nothing. - Drop CI state from the required-evidence count. The pre-flight now guarantees terminal CI, so the agent never gathers it and it could never be the missing item that caps confidence. Counting it made the gate for High confidence four items dressed up as five. - Log which PRs the terminal-CI gate excluded. A check that never reports would otherwise keep a PR out of triage permanently and silently. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695

`statusCheckRollup` contexts are CheckRun and StatusContext objects, which sit behind the `checks` and `statuses` scopes. The workflow token had neither, so the field would have come back unreadable at runtime even though it reads fine with a developer token, which is what I tested with. The dangerous part was not the missing permission but how the gate reacted to it. `[.statusCheckRollup[]? | select(pending)] | length == 0` cannot tell "this PR has no checks" from "I could not read this PR's checks", so an unreadable rollup counted as terminal CI and the PR would have been assessed while its CI was still running. Silently wrong beats loudly broken only from the outside. So the classification now treats a null rollup as pending and names it in the skip log, and the permissions are granted. The gate fails safe if either is ever dropped again. Also warn when the listing hits the 100-PR cap. gh truncates silently and the ordering is stable, so PRs past the cap would never be reached on a later run either. Paginating for a case that far outside anything this repository has seen, and well above the 20-comment safe-output cap, is not worth the extra requests, but the condition should not be invisible. Reported by Copilot review on #14079. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695

Make Dependabot triage cheaper and more decisive

…igstore/sigstore-go-1.3.0 chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0

Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.7 to 0.21.8. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.7...v0.21.8) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…ctions-432e0d4de6 chore(deps): bump the codeql-actions group across 1 directory with 3 updates

…g.org/grpc-1.83.0 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0

…oogle/go-containerregistry-0.21.8 chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cd6661ad-7e77-46d0-b0e7-0a296f4e252b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 18bc01f9-9498-4bd8-9fd0-70308491b695

Copilot-Session: e00d0ec3-c3d6-4ee7-9100-a7f294fe2402

…attest-4.2.1 chore(deps): bump actions/attest from 4.2.0 to 4.2.1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: 7db06537-cb57-48b9-b09c-e0ea393c3734 Copilot-Session: 6dba8ad8-2a85-4cda-a057-cf91b58a158e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: db48c8cb-9607-4607-8000-121b01833106

Bumps [actions/attest](https://github.com/actions/attest) from 4.2.1 to 4.2.2. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](actions/attest@508db95...1e69f48) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [azure/login](https://github.com/azure/login) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@532459e...f5d393a) --- updated-dependencies: - dependency-name: azure/login dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…updates Bumps the codeql-actions group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f205ea1...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] <support@github.com>

Agents were filling "How did you test this change?" with unit test output, which duplicates CI and tells reviewers nothing about whether the change actually works for a user. Spell out the acceptable forms instead: screenshots/GIFs, Given/When/Then, or a plain walkthrough. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: af0c0477-c30c-4c0f-b198-42ce0cd450f3

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: db48c8cb-9607-4607-8000-121b01833106