fix(copilot): re-approve the baseline for measurement scope 2 - #120
Merged
Conversation
#119 committed the baseline and #117 widened the MCP path list. They landed in that order, so `main` carries a scope 1 baseline against a scope 2 engine and the gate fails every new pull request with a re-approval notice until someone re-approves. This is the scope mechanism doing its job, not a defect: it refuses to guess whether a newly measured file was always there or was just added. It still needs the one action it asks for. Re-approved with `python copilot/engine/capture.py approve`. The composition itself is unchanged and still empty; only `scope` moves from 1 to 2. Also turns the pull-request comment back on for pull requests from this repository. It was disabled outright to keep fork pull requests read-only, which is the right instinct with the wrong blast radius: it also removed the comment from every internal pull request, which is the integration's main output. The job now requests pull-requests: write and passes `comment` only when head and base are the same repository, so forks stay read-only and get the job summary, which carries the same content. Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
Copilot agent composition unchangedNothing added, nothing subtracted in the instructions, skills and MCP configuration this repository gives Copilot. |
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainis currently failing the Copilot integrity gate on every new pull request. This fixes it.What happened
#119 committed
.agentrust/copilot-baseline.jsonat scope 1. #117 widened the MCP path list and movedMEASUREMENT_SCOPEto 2. They landed in that order, so the committed baseline is now a scope behind the engine that reads it, andfail-on-drift: trueturns that into a red check for everyone.This is the scope mechanism working: it refuses to guess whether a newly measured file was always present or was just added. The baseline is re-approved at scope 2; the measured composition remains empty.
Security review
An earlier revision restored internal pull-request comments by granting
pull-requests: writeto the same job that executes the pull request's local action code. That expansion was removed during review. Verification remains read-only, with no persisted checkout credentials and no comment permission.Restoring internal comments safely is separate work because it needs a trust boundary that does not execute head-controlled code under a write-capable token.
Evidence
python copilot/engine/capture.py verifyexits 0 on this head.mainchanges only the generated baseline scope and capture time.