Optimize safe output checkout with shallow clone and targeted branch fetching #7176

Copilot · 2025-12-22T00:28:48Z

Safe output jobs for create-pull-request and push-to-pull-request-branch performed full repository checkouts (fetch-depth: 0), which is expensive for large repositories. This changes them to shallow clones with explicit branch fetching.

Changes

Go compiler changes:

Modified buildCreatePullRequestPreStepsConsolidated() and buildPushToPullRequestBranchPreStepsConsolidated() to use fetch-depth: 1 instead of fetch-depth: 0

JavaScript runtime changes:

create_pull_request.cjs: Replaced git fetch origin with git fetch origin ${baseBranch}:${baseBranch} to fetch only the base branch
push_to_pull_request_branch.cjs: Replaced git fetch origin with git fetch origin ${branchName}:refs/remotes/origin/${branchName} to fetch only the target branch

Example

Before:

await exec.exec("git fetch origin");  // Fetches all branches
await exec.exec(`git checkout ${baseBranch}`);

After:

await exec.exec(`git fetch origin ${baseBranch}:${baseBranch}`);  // Fetches only needed branch
await exec.exec(`git checkout ${baseBranch}`);

This reduces clone time and network transfer significantly for repositories with extensive history.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login oad-artifact.git php8.3 /usr/bin/git l 4 /usr/bin/git git for-�� b/workflows %(refname) /usr/bin/git l a255aa63a3cc5ba3rev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api user --jq .login it/ref/tags/v5 git (http block)
- Triggering command: /usr/bin/gh gh api user --jq .login ithub/workflows origin e/git-remote-https xterm-color (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

The safe output job should emit a shallow checkout step for the create-pull-request or push-to-pull-request-branch because some repositories are huge and it is an expensive task.

Instead, the JavaScript should run git command to ensure that the branches required are available.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: pelikhan <[email protected]>

Changed fetch-depth from 0 to 1 for create-pull-request and push-to-pull-request-branch safe outputs. JavaScript now explicitly fetches required branches using git commands. Co-authored-by: pelikhan <[email protected]>

github-actions · 2025-12-22T01:06:27Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-22T01:21:06Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2025-12-22T01:21:07Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2025-12-22T01:21:08Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2025-12-22T01:21:08Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-22T01:21:09Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-22T01:21:09Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2025-12-22T01:21:10Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2025-12-22T01:23:29Z

Smoke Test Results - Copilot Engine

Last 2 merged PRs:

[security-fix] Fix clear-text logging of sensitive information in secrets validation #7178: Security fix - clear-text logging
Keep map_helpers.go and git_helpers.go as standalone files #7175: Helper files review

Test Results:

✅ GitHub MCP: Accessed merged PRs
✅ File Writing: Created & verified test file
✅ Bash Tool: Executed commands successfully
✅ Default Toolset: get_me correctly unavailable
✅ Cache Memory: Read/write successful

Overall Status: PASS

cc: @pelikhan

📰 BREAKING: Report filed by Smoke Copilot fer issue #7176 🗺️

github-actions · 2025-12-22T01:23:30Z

Smoke Test Results

✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-20418939388.txt
✅ Bash Tool: Verified file content successfully
❌ Safe Input gh Tool: safeinputs-gh tool not available

Status: PARTIAL PASS (2/3 tests passed)

Ahoy! This treasure was crafted by 🏴‍☠️ Smoke Copilot Safe Inputs fer issue #7176 🗺️

github-actions · 2025-12-22T01:23:35Z

Smoke Test Results: Copilot Engine (No Firewall)

Last 2 Merged PRs:

[security-fix] Fix clear-text logging of sensitive information in secrets validation #7178: Fix clear-text logging of sensitive information in secrets validation
[docs] Update documentation for shorthand label trigger syntax #7173: Update documentation for shorthand label trigger syntax

Test Results:

✅ GitHub MCP: Retrieved PRs successfully
✅ File Writing: Created test file in /tmp/gh-aw/agent/
✅ Bash Tool: Verified file creation (Mon Dec 22 01:22:39 UTC 2025)
✅ Playwright MCP: Navigated to github.com, title contains "GitHub"
⏳ Safe Input gh Tool: Testing now...

Status: Running final test

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #7176 🗺️

github-actions · 2025-12-22T01:24:12Z

Firewall smoke test (Codex + AWF)
PRs: [security-fix] Fix clear-text logging of sensitive information in secrets validation; [docs] Update documentation for shorthand label trigger syntax
OpenAI curl blocked: ✅
example.com blocked: ✅
GitHub MCP (PR titles fetched): ✅
File write/read: ✅ (/tmp/gh-aw/agent/smoke-test-codex-firewall-20418939393.txt)
Network: SANDBOXED | Overall: PASS

🔥 Firewall tested by Smoke Codex Firewall fer issue #7176 🗺️

github-actions · 2025-12-22T01:24:22Z

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

[security-fix] Fix clear-text logging of sensitive information in secrets validation #7178: [security-fix] Fix clear-text logging of sensitive information
[docs] Update documentation for shorthand label trigger syntax #7173: [docs] Update documentation for shorthand label trigger syntax

Test Results:
✅ GitHub MCP - Retrieved PRs successfully
✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-claude-20418939409.txt
✅ Bash Tool - Verified file creation
✅ Playwright MCP - Navigated to GitHub, title verified: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
✅ Cache Memory - Created /tmp/gh-aw/cache-memory/smoke-test-20418939409.txt
❌ Safe Input gh Tool - Tool not available in this environment

Status: PASS (5/6 core tests passed)

💥 [THE END] — Illustrated by Smoke Claude fer issue #7176 🗺️

github-actions · 2025-12-22T01:24:24Z

Recent merged PRs: [security-fix] Fix clear-text logging of sensitive information in secrets validation; [docs] Update documentation for shorthand label trigger syntax
GitHub MCP (last 2 merged PRs): ✅
File write /tmp/gh-aw/agent & cat: ✅
Playwright title contains "GitHub": ✅
Cache memory file write & cat: ✅
safeinputs-gh gh issues list --limit 3: ❌ (command not found)
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #7176 🗺️

Initial plan

3dcd87d

Copilot AI assigned Copilot and pelikhan Dec 22, 2025

Copilot started work on behalf of pelikhan December 22, 2025 00:29 View session

Copilot AI and others added 3 commits December 22, 2025 00:33

Initial plan for shallow checkout optimization

a255aa6

Co-authored-by: pelikhan <[email protected]>

Optimize safe output checkout with shallow depth and git fetch

de3f8cc

Changed fetch-depth from 0 to 1 for create-pull-request and push-to-pull-request-branch safe outputs. JavaScript now explicitly fetches required branches using git commands. Co-authored-by: pelikhan <[email protected]>

Apply code formatting (trailing commas)

9997bf6

Copilot AI changed the title ~~[WIP] Add shallow checkout step for safe output job~~ Optimize safe output checkout with shallow clone and targeted branch fetching Dec 22, 2025

Copilot AI requested a review from pelikhan December 22, 2025 00:51

Copilot finished work on behalf of pelikhan December 22, 2025 00:51

pelikhan added the changeset label Dec 22, 2025

Add changeset [skip-ci]

cc7c2c9

pelikhan added the smoke label Dec 22, 2025

github-actions bot added the smoke-copilot label Dec 22, 2025

github-actions bot added the smoke-copilot-no-firewall label Dec 22, 2025

github-actions bot added the smoke-codex-firewall label Dec 22, 2025

github-actions bot added the smoke-claude label Dec 22, 2025

Add changeset [skip-ci]

a5a09ca

pelikhan marked this pull request as ready for review December 22, 2025 01:24

pelikhan merged commit 635b809 into main Dec 22, 2025
5 checks passed

pelikhan deleted the copilot/add-shallow-checkout-step branch December 22, 2025 01:25

Optimize safe output checkout with shallow clone and targeted branch fetching #7176

Optimize safe output checkout with shallow clone and targeted branch fetching #7176

Uh oh!

Conversation

Copilot AI commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Example

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Dec 22, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 22, 2025

Smoke Test Results - Copilot Engine

Uh oh!

github-actions bot commented Dec 22, 2025

Smoke Test Results

Uh oh!

github-actions bot commented Dec 22, 2025

Smoke Test Results: Copilot Engine (No Firewall)

Uh oh!

github-actions bot commented Dec 22, 2025

Uh oh!

github-actions bot commented Dec 22, 2025

Smoke Test Results - Claude Engine

Uh oh!

github-actions bot commented Dec 22, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited by agentic-workflows-dev bot

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading

github-actions bot commented Dec 22, 2025 •

edited

Loading