Enforce gh-aw v0.85.3 security compatibility floor by Copilot · Pull Request #55796 · github/gh-aw

Copilot · 2026-08-25T14:08:15Z

Updates the compatibility policy for GHSA-8h78-hpm7-29gg and adds reusable guidance for translating security advisories into targeted compatibility changes.

Changes

Compatibility enforcement
- Raises minimumVersion from v0.65.3 to v0.85.3.
- Preserves blocked, recommended, and agent compatibility policies.
Advisory workflow
- Adds security-advisory-compat-enforcer.
- Requires evidence-backed policy selection, monotonic version floors, schema validation, and preservation of unrelated fields.

"minimumVersion": "v0.85.3"

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-25T16:11:18Z

@copilot can you ban the range of releases flagged by the advisory?

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T16:21:05Z

@copilot can you ban the range of releases flagged by the advisory?

Addressed in 313ee1e: blockedVersions now enumerates every affected release from v0.82.8 through v0.85.2, while the general minimum remains v0.65.3.

pelikhan · 2026-08-25T16:43:49Z

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T16:50:10Z

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

Corrected in b435280: v0.85.3 is now blocked, so v0.85.4 is the first allowed release.

pelikhan · 2026-08-25T17:39:19Z

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the advisories

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T18:05:15Z

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the adv...

Addressed in b3644de: the skill now requires the compatibility CI task plus Draft 7 schema validation, and .github/aw/compat.md documents the blocked v0.82.8–v0.85.3 range with the GHSA link.

pelikhan · 2026-08-25T20:14:07Z

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

pelikhan · 2026-08-25T20:16:54Z

@copilot the skill should tell the agent to provide remediation instructions, similarly to the advisory (see updated content in https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg)

Review the skill wording and habits and apply best practices from the security comunity, known CVE way of wording, specifying things.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T20:22:26Z

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

Addressed in e5e0922: added TestCompatJSONConformsToSchema, which compiles .github/aw/compat.schema.json and validates .github/aw/compat.json against it.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Revokes gh-aw versions affected by GHSA-8h78-hpm7-29gg and adds reusable advisory-handling guidance.

Changes:

Blocks versions v0.82.8–v0.85.3.
Documents upgrade remediation.
Adds compatibility schema validation coverage.

Show a summary per file

File	Description
`.github/aw/compat.json`	Adds affected versions to the blocklist.
`.github/aw/compat.md`	Documents impact and remediation.
`.github/skills/security-advisory-compat-enforcer/SKILL.md`	Adds advisory enforcement guidance.
`.github/skills/agentic-workflows/SKILL.md`	Registers compatibility documentation.
`pkg/linters/compat_schema_test.go`	Validates compatibility configuration against its schema.

Review details

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Balanced

Copilot · 2026-08-26T18:26:19Z

 {
  "$schema": "./compat.schema.json",
-  "blockedVersions": [],
+  "blockedVersions": [


Agreed, the PR description was inaccurate. The implemented policy is: blockedVersions enumerates the exact affected range v0.82.8–v0.85.3 (per GHSA-8h78-hpm7-29gg), minimumVersion stays at v0.65.3, and minRecommendedVersion is now v0.85.4 for the upgrade nudge. I'll update the PR title/description to reflect this.

pelikhan · 2026-08-26T18:09:35Z

@copilot fix https://github.com/github/gh-aw/actions/runs/32980123710/job/98215139311?pr=55796 and run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…ndedVersion, add boundary test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-08-26T22:37:08Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers.
Revisit the open maintainer ask to fix the failing job and then run the pr-finisher skill.
Most recent maintainer instruction: Enforce gh-aw v0.85.3 security compatibility floor #55796 (comment)

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.03 AIC · ⌖ 8.03 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-26T22:46:39Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers....

Status update:

The technical concerns raised by the automated CHANGES_REQUESTED reviews (missing minRecommendedVersion bump, boundary tests, broken remediation link) were already addressed in b2d52b0 and replied to on each thread.
The minimumVersion vs blockedVersions semantics question was resolved per @pelikhan's explicit direction in this PR's history (ban the exact affected range, corrected to include v0.85.3): blockedVersions enumerates v0.82.8–v0.85.3, minimumVersion stays v0.65.3, minRecommendedVersion is now v0.85.4.
Fixed the failing job (https://github.com/github/gh-aw/actions/runs/32980123710/job/98215139311, TestFallbackAWFilesMatchesLocalAWDirectory) by adding compat.md to the embedded fallback file list.
Ran the full pr-finisher validation pass (make agent-report-progress, code_review, codeql_checker) — all pass clean with no new findings.

I don't have permissions to resolve GitHub review threads or edit the PR title/description directly from this environment — those need a maintainer action. All code-level asks are done and pushed.

gh-aw-bot · 2026-08-26T23:52:34Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers.
Please refresh the branch if needed and run the pr-finisher skill before handing back.
Recent automated review summary: Enforce gh-aw v0.85.3 security compatibility floor #55796

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 13.9 AIC · ⌖ 8.09 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

…-json-to-0853 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-26T23:59:48Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers....

Refreshed the branch: merged 12 new commits from main (a6e0791), no conflicts, make agent-report-progress passes clean after the merge.

All actionable review feedback from automated reviewers was already addressed and replied to in prior commits (b2d52b0): minRecommendedVersion bumped to v0.85.4, boundary test added, broken remediation link fixed, and the minimumVersion/blockedVersions semantics question clarified per the maintainer's explicit direction earlier in this thread.

Remaining items (resolving GitHub review threads, editing the PR title/description) require repo-write actions this agent doesn't have access to in this sandbox — those need a maintainer.

github-actions · 2026-08-27T02:06:04Z

Category: chore; risk: high; score: 75/100 (impact 40/50, urgency 21/30, quality 14/20); recommended action: fast_track; CI: pending/unknown; review signal: 12 reviews, 26 issue comments.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 13.5 AIC · ⌖ 2.44 AIC · ⊞ 16.6K · ◷

done

github-actions · 2026-08-27T09:29:49Z

Generated by 🔧 PR Triage Agent · copilot · mai10 · 17.8 AIC · ⌖ 2.49 AIC · ⊞ 16.6K · ◷

Enforce secure gh-aw compatibility floor

9ba74a6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Aug 25, 2026

Copilot finished work on behalf of pelikhan August 25, 2026 14:09

Copilot created this pull request from a session on behalf of pelikhan August 25, 2026 14:09 View session

Copilot AI requested a review from pelikhan August 25, 2026 14:09

Copilot started work on behalf of pelikhan August 25, 2026 16:11 View session

Ban advisory-affected gh-aw releases

313ee1e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 16:21

Copilot started work on behalf of pelikhan August 25, 2026 16:44 View session

Correct advisory release boundary

b435280

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 16:50

Copilot started work on behalf of pelikhan August 25, 2026 17:39 View session

Document blocked compatibility versions

b3644de

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 18:05

github-actions Bot mentioned this pull request Aug 25, 2026

[PR Triage Report] PR triage report: no eligible Copilot PRs due to cooldown #55842

Closed

Copilot started work on behalf of pelikhan August 25, 2026 20:14 View session

Test compat configuration schema validation

e5e0922

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 20:22

Copilot started work on behalf of pelikhan August 25, 2026 20:23 View session

Add advisory remediation guidance

1033341

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot mentioned this pull request Aug 26, 2026

[aw] No-Op Runs #48838

Open

Copilot AI reviewed Aug 26, 2026

View reviewed changes

Merge branch 'main' into copilot/update-combat-json-to-0853

3ec639e

Copilot started work on behalf of pelikhan August 26, 2026 18:09 View session

Copilot AI and others added 2 commits August 26, 2026 18:22

Fix fallback AW files list to include compat.md

3b02852

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Address review feedback: fix broken remediation link, bump minRecomme…

b2d52b0

…ndedVersion, add boundary test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 26, 2026 18:27

github-actions Bot mentioned this pull request Aug 26, 2026

[pr-sous-chef] PR Sous Chef run report #55899

Closed

Copilot started work on behalf of gh-aw-bot August 26, 2026 22:37 View session

Copilot finished work on behalf of gh-aw-bot August 26, 2026 22:47

Copilot AI requested a review from gh-aw-bot August 26, 2026 22:47

Copilot started work on behalf of gh-aw-bot August 26, 2026 23:52 View session

Merge remote-tracking branch 'origin/main' into copilot/update-combat…

a6e0791

…-json-to-0853 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 27, 2026 00:00

github-actions Bot mentioned this pull request Aug 27, 2026

[pr-sous-chef] PR Sous Chef run report #56159

Open

github-actions Bot added pr-action:fast-track pr-priority:high pr-risk:high labels Aug 27, 2026

github-actions Bot mentioned this pull request Aug 27, 2026

[PR Triage Report] PR triage report - 2026-08-27 #56206

Closed

Merge branch 'main' into copilot/update-combat-json-to-0853

778f022

github-actions Bot mentioned this pull request Aug 27, 2026

[PR Triage Report] PR triage report for Copilot-authored PRs (2026-08-27) #56300

Open

github-actions Bot added the pr-batch:permissions-security label Aug 27, 2026

Uh oh!

Conversation

Copilot AI commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Copilot AI Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Aug 26, 2026

Uh oh!

gh-aw-bot commented Aug 26, 2026

Uh oh!

Copilot AI commented Aug 26, 2026

Uh oh!

gh-aw-bot commented Aug 26, 2026

Uh oh!

Copilot AI commented Aug 26, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 25, 2026 •

edited

Loading