Repository navigation
chore: sync actions from gh-aw@v0.92.4 - #280
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive redaction changes have verified regressions requiring correction and human review.
6 open findings
What changed in this PR
Syncs the action runtime from gh-aw v0.92.4, updating redaction, workflow diagnostics, and supporting tooling.
Changes:
- Adds schema-aware redaction and shared credential-matching helpers.
- Records dependency job results and durations; refines failure classification.
- Updates gateway behavior, cache restoration, checkout handling, and test isolation.
| File | Description |
|---|---|
setup/setup.sh |
Copies additional runtime dependencies. |
setup/session_parsers.go |
Embeds new parser dependencies. |
setup/js/workflow_job_durations.cjs |
Collects completed dependency-job durations. |
setup/js/work_queue_control_adapter_checks.cjs |
Checks attempt-specific run lookup. |
setup/js/vitest.config.mjs |
Enables isolated safe-output test setup. |
setup/js/unified_session.cjs |
Collects job results and durations. |
setup/js/unified_session_render.cjs |
Renders job-result events. |
setup/js/unified_session_payload.cjs |
Preserves job-result payload fields. |
setup/js/types/unified_session.d.ts |
Defines job-result event types. |
setup/js/start_mcp_gateway.cjs |
Adjusts retry sizing and process checks. |
setup/js/scripts/test_safeoutputs_setup.mjs |
Isolates test CLI paths and outputs. |
setup/js/scripts/fixtures/safeoutputs.cjs |
Provides a local test CLI fixture. |
setup/js/safe_output_redaction.cjs |
Adds schema-aware safe-output redaction. |
setup/js/restore_aic_scan_cache.cjs |
Reads restore candidates lazily. |
setup/js/report_failed_jobs.cjs |
Exports collected job durations. |
setup/js/redact_secrets.cjs |
Integrates structured and shared redaction. |
setup/js/parse_mcp_gateway_log.cjs |
Bounds gateway summary sizes. |
setup/js/package.json |
Overrides minimatch v3 dependency resolution. |
setup/js/mask_value_matcher.cjs |
Shares credential matching and overlap handling. |
setup/js/json_string_scanner.cjs |
Scans quoted JSON tokens. |
setup/js/harness_error_patterns.cjs |
Restricts detection to native error diagnostics. |
setup/js/handle_agent_failure.cjs |
Refines cancellation-related output handling. |
setup/js/empty_output_outcome.cjs |
Recognizes failed engine final results. |
setup/js/create_prompt.cjs |
Includes complete work-queue assignments. |
setup/js/collect_ndjson_output.cjs |
Reports failed final engine results. |
setup/js/checkout_pr_branch.cjs |
Expands trusted bot event handling. |
setup/js/ai_credits_context.cjs |
Refines native credit-limit error detection. |
setup/js/agent_execution.cjs |
Classifies attributed native guard diagnostics. |
setup/js/add_mask_redaction.cjs |
Extends token-aware and escaped-value redaction. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+351
to
+352
| const redacted = JSON.stringify((redactJSONValue || redactValue)(value)); | ||
| return redacted === JSON.stringify(value) ? numericRedacted : text.match(/^\s*/)[0] + redacted + text.match(/\s*$/)[0]; |
| return name || configured.has(value) ? "***REDACTED***" : "***"; | ||
| }; | ||
| // Protocol callbacks already receive decoded strings, not serialized artifacts. | ||
| const redacted = options.decodedText ? redactDecodedCredentialText(content, values, replacement) : redactArtifactMaskedValues(content, values, undefined, replacement, { textMode: !isValidJSONArtifact(content) }); |
| core.info(`Secret redaction sizes: input_bytes=${inputBytes} output_bytes=${Buffer.byteLength(structured, "utf8")} format=structured`); | ||
| return redactionCount; | ||
| } | ||
| const encodedResult = path.extname(filePath).toLowerCase() === ".html" ? redactPiSessionHTML(content, text => redactArtifactContent(text, secretValues, maskedValues)) : { content, redactionCount: 0 }; |
| const control = | ||
| filePath === process.env.GH_AW_SAFE_OUTPUTS_CONFIG_PATH || filePath === process.env.GH_AW_VALIDATION_CONFIG_PATH || (path.basename(path.dirname(filePath)) === "safeoutputs" && ["config.json", "validation.json"].includes(name)); | ||
| const envelope = name === "agent_output.json"; | ||
| if (!control && !envelope && name !== "safeoutputs.jsonl" && filePath !== process.env.GH_AW_SAFE_OUTPUTS) return null; |
| return withoutCommands === value ? encoded : JSON.stringify(withoutCommands); | ||
| }); | ||
| // A registered raw whole-line value removes all of the original syntax. | ||
| return ambiguous && !maskedValues.includes(text) ? JSON.stringify(redacted) : redacted; |
| const hasTerminalOutput = parsedItems.some(item => !["missing_tool", "missing_data"].includes(item.type)); | ||
| let failedFinalResult = false; | ||
| let session; | ||
| if (!queueScope && hasTerminalOutput) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync of actions from gh-aw at
v0.92.4.