[efraespada]

Closes #647.

Repositories can prepare dependencies for the actual merge or fix candidate through .github/actions/copilot-verification-setup/action.yml, a native composite action with reviewed auxiliary files. Generated comment callbacks run its uses and run steps before each configured verifier, then continue the same admitted operation without replaying the agent.

Setup is disabled by default (VERIFICATION_SETUP, Action input verification-setup, setup config repository.verificationSetup). Copilot pins the action from trusted main and stages it under .git, preserving the candidate's files. Native continuations check the request and candidate, accept only approved runtime paths and JAVA_HOME, and retain credential-free verification and existing publication guards. Setup failure blocks pending verification and publication. Dependency profiles and trusted action metadata remain available until native post steps finish, then are removed. Source workflows also snapshot their runtime outside the mutable candidate.

The installer preserves the consumer-owned action directory. Updated specifications, catalog, generated guidance and documentation explain configuration, limits, recovery and the local CLI limitation: composite setup requires the updated GitHub Actions callbacks; an opted-in CLI invocation fails closed.

Validation on 5ba7f589: CI passes 703 suites and 11,510 tests, coverage budgets, workflow/specification/documentation validators and synchronized bundles. Platform smoke passes on Linux, Windows and macOS, including actual Python/pytest and Node/pnpm setup, full platform coverage, deferred post steps, runtime replacement protection and cleanup. Regression cases block untracked executable-mode and file-type changes. The complete review confirms zero active findings: two fixed and three dismissed with evidence. All applicable final-head checks pass; optional manual jobs are skipped and the protected-path approval recommendation remains neutral.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~652

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 5ba7f58. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 398723d was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Setup option is ignored by the commit workflow — .github/workflows/copilot_commit.yml:54

[vypbot]

Bugbot: review complete

Current status: No active findings on 5ba7f58.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: 5ba7f589c0ba; base: bb67cb4227a4; reason: protected-path.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 91.76030% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.09%. Comparing base (274db40) to head (5ba7f58).
⚠️ Report is 1590 commits behind head on develop.

Files with missing lines	Patch %	Lines
...c/infrastructure/native_verification_controller.ts	89.53%	5 Missing and 13 partials ⚠️
src/infrastructure/verification_setup_snapshot.ts	83.92%	2 Missing and 7 partials ⚠️
...rc/infrastructure/native_verification_candidate.ts	86.66%	1 Missing and 3 partials ⚠️
src/infrastructure/native_verification_protocol.ts	87.87%	0 Missing and 4 partials ⚠️
src/infrastructure/verification_setup_result.ts	90.32%	1 Missing and 2 partials ⚠️
src/infrastructure/verification_setup_runner.ts	95.91%	0 Missing and 2 partials ⚠️
src/infrastructure/git_commit_adapter.ts	90.90%	0 Missing and 1 partial ⚠️
src/infrastructure/native_verification_profiles.ts	96.00%	0 Missing and 1 partial ⚠️
...frastructure/native_verification_source_runtime.ts	90.90%	1 Missing ⚠️
src/infrastructure/native_verification_staging.ts	96.55%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #652      +/-   ##
===========================================
+ Coverage    90.94%   94.09%   +3.14%     
===========================================
  Files          135      966     +831     
  Lines         6251    31185   +24934     
  Branches      1338     9160    +7822     
===========================================
+ Hits          5685    29343   +23658     
- Misses         172      715     +543     
- Partials       394     1127     +733     

Files with missing lines	Coverage Δ
src/actions/github_action.ts	95.72% <100.00%> (+13.79%)	⬆️
src/actions/github_action_execution.ts	93.75% <ø> (ø)
src/actions/local_action_configuration_sections.ts	86.00% <ø> (ø)
src/actions/local_action_execution.ts	92.30% <ø> (ø)
src/application/contracts/input_keys.ts	100.00% <ø> (ø)
...ation/policies/repository_agent_guidance_policy.ts	100.00% <ø> (ø)
...plication/policies/setup_configuration_defaults.ts	96.72% <ø> (ø)
...c/application/policies/setup_configuration_plan.ts	94.25% <100.00%> (ø)
...ication/policies/setup_configuration_validation.ts	67.01% <100.00%> (ø)
...n/policies/setup_organization_variable_bindings.ts	100.00% <ø> (ø)
... and 19 more

... and 1004 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[efraespada]

/copilot dismiss "copilot_commit_workflow:54:verification-setup-not-applied-to-commit-route"

[vypbot]

1 finding was dismissed.

[efraespada]

Design revision in progress following the maintainer's request for repository-owned YAML integrated with Copilot workflows. This PR is now a draft with no automatic merge. The current Node helper implementation is retained for comparison and must not be treated as the accepted final interface.

The native alternatives under discussion are a composite setup action in the same job (recommended for shared workspace/environment), or a reusable workflow that receives the candidate and performs setup and verification in its own jobs. Both require explicit prepare/setup/verify-publication phases and fresh candidate/authorization checks; a setup-only job cannot provision another job's environment. Native logging/limits, trusted YAML provenance, cancellation/recovery and local CLI behavior must be specified before implementation is finalized.

The earlier push-route finding was independently checked and dismissed with pinned source evidence: that route performs analysis/metadata work and has no repository verification boundary.

[vypbot]

1 finding was dismissed.

[efraespada]

/copilot findings

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 5ba7f58. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 920335a was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Candidate identity ignores untracked file permissions — src/infrastructure/native_verification_candidate.ts:29