Skip warnings for actions already pinned to full SHAs by Copilot · Pull Request #8815 · github/gh-aw

Copilot · 2026-01-04T01:29:40Z

Actions pinned to full 40-character SHAs were triggering unnecessary dynamic resolution warnings like:

⚠ Unable to resolve actions/checkout@93cb6efe18208431cddfb9bfd dynamically, using hardcoded pin for actions/checkout@v5.0.1

Changes

Modified GetActionPinWithData() to detect and handle SHA-based versions:

Skip dynamic resolution for SHAs (GitHub API can't resolve commit SHAs to tags)
Check hardcoded pins for SHA matches to preserve version tag annotation
Suppress warnings throughout all code paths when version is a SHA

Added test coverage:

TestGetActionPinWithData_AlreadySHA verifies no warnings for SHA-pinned actions
Validates both known SHAs (annotated with version tags) and unknown SHAs (returned as-is)

Behavior

# Before: Warning issued
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

# After: No warning, SHA annotated if known in pins
# → actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

Preserves existing SHA-to-version annotation when SHA matches a hardcoded pin.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login -json GO111MODULE 0.1-go1.25.0.linGOMODCACHE GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 0.1-go1.25.0.linux-amd64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

No need to issue warnings for custom actions pinned to a long sha. See this error when compiling:

⚠ Unable to resolve actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd dynamically, using hardcoded pin for actions/checkout@v5.0.1
⚠ Unable to resolve actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f dynamically, using hardcoded pin for actions/setup-node@v6.1.0
✓ .github/workflows/playground-snapshots-refresh.md (54.3 KB)

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Skip dynamic resolution warnings for actions pinned to full SHAs; preserve known SHA->version annotations when available.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

pelikhan · 2026-01-04T01:30:57Z

@copilot same error here:

⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed
✓ .github/workflows/daily-fact.md (49.0 KB)

When a user provides an action with a full 40-character SHA (e.g., actions/checkout@93cb6efe...), the system now recognizes it's already pinned and returns it immediately without issuing warnings about dynamic resolution failure. This fixes the issue where users saw unnecessary warnings like: "⚠ Unable to resolve actions/checkout@93cb6efe... dynamically, using hardcoded pin for actions/checkout@v5.0.1" Changes: - Modified GetActionPinWithData() to check if version is already a full SHA before attempting dynamic resolution - Added test TestGetActionPinWithData_AlreadySHA to verify no warnings are issued for SHA-pinned actions - Uses existing isValidFullSHA() function from features_validation.go Fixes issue with warnings for SHA-pinned custom actions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refined the approach to preserve existing behavior while suppressing warnings: - When a version is a SHA and matches a hardcoded pin, annotate it with the version tag (e.g., actions/checkout@SHA # v5.0.1) - When a version is a SHA that doesn't match any pin, return it as-is - Only skip dynamic resolution attempts for SHAs (they can't be resolved anyway) - Suppress warnings for SHAs in all code paths This preserves the useful behavior of annotating known SHAs with their version tags while eliminating unnecessary warnings like: "⚠ Unable to resolve actions/checkout@93cb6efe... dynamically" All existing tests pass including TestApplyActionPinToStep which expects SHA-to-version-tag annotation. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-01-04T01:59:36Z

🎉 Yo ho ho! Smoke Copilot Safe Inputs found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-04T01:59:36Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-01-04T01:59:36Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2026-01-04T01:59:37Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-01-04T01:59:37Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-01-04T01:59:38Z

✅ Firewall validation complete... Smoke Codex Firewall confirmed network sandboxing is operational. 🛡️

github-actions · 2026-01-04T01:59:39Z

🤖 DIAGNOSTIC COMPLETE: Smoke Copilot No Firewall STATUS: ALL_UNITS_OPERATIONAL. MISSION_SUCCESS.

github-actions · 2026-01-04T01:59:40Z

📰 VERDICT: Smoke Copilot Playwright has concluded. All systems operational. This is a developing story. 🎤

Copilot · 2026-01-04T01:59:56Z

@copilot same error here:

⚠ Unable to pin action githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c: resolution failed

...

The fix is already in place in commit f085d95. I tested compiling .github/workflows/daily-fact.md with the current code and confirmed no warnings are issued for the custom action SHA githubnext/gh-aw/actions/setup@623e612ff6a684e9a8634449508bdda21e2c178c.

Please rebuild the binary with make build to pick up the changes. The fix handles all SHA-based versions including custom actions with the action-tag feature.

github-actions · 2026-01-04T02:01:34Z

Smoke Test Results: Copilot Safe Inputs

✅ File Writing: Successfully created /tmp/gh-aw/agent/smoke-test-copilot-20686026485.txt
✅ Bash Tool: File verification successful
❌ safeinputs-gh Tool: Tool not available in current context

Overall Status: FAIL

The safeinputs-gh tool is not accessible in this workflow execution.

AI generated by Smoke Copilot Safe Inputs

github-actions · 2026-01-04T02:01:41Z

Copilot Smoke Test Results

Last 2 Merged PRs:

Add default value to engine field in included_file_schema.json #8814: Add default value to engine field in included_file_schema.json
Add $comment validation documentation to stdio_mcp_tool in included schema #8813: Add $comment validation documentation to stdio_mcp_tool in included schema

Test Results:

✅ GitHub MCP Testing (fetched PRs successfully)
✅ File Writing Testing (created agent test file)
✅ Bash Tool Testing (verified file creation)
✅ GitHub MCP Default Toolset (confirmed get_me not in default toolsets - error as expected)
✅ Cache Memory Testing (created and verified cache file)
✅ Available Tools: add_comment, add_labels, create_issue, missing_tool, noop

Overall Status: PASS ✅

@pelikhan

AI generated by Smoke Copilot

github-actions · 2026-01-04T02:01:56Z

Smoke: Codex firewall
PRs: Add default value to engine field in included_file_schema.json; Add $comment validation documentation to stdio_mcp_tool in included schema
OpenAI curl blocked: ✅
example.com blocked: ✅
GitHub MCP merged PRs fetched: ✅
File write/read in /tmp/gh-aw/agent: ✅
Network: SANDBOXED | Overall: PASS

AI generated by Smoke Codex Firewall

github-actions · 2026-01-04T02:02:02Z

Smoke Test Results - Copilot Engine (No Firewall)

✅ All tests passed successfully

✅ Retrieved last 2 merged PRs (Add default value to engine field in included_file_schema.json #8814, Add $comment validation documentation to stdio_mcp_tool in included schema #8813)
✅ Created test file /tmp/gh-aw/agent/smoke-test-copilot-20686026487.txt
✅ Navigated to https://github.com - Page title verified: "GitHub · Change is constant. GitHub keeps you ahead. · GitHub"
✅ Listed 3 issues using safeinputs-gh (Copilot Smoke Test Results - Run 20685598288 #8811, [plan] Document tools scope restrictions in reference docs #8809, [plan] Document safe-outputs scope restrictions in reference docs #8808)

AI generated by Smoke Copilot No Firewall

github-actions · 2026-01-04T02:02:19Z

Smoke Test Results

❌ Playwright MCP Test: FAIL - Playwright module not available
✅ Cache Memory Test: PASS - File written and verified
❌ Safe Input gh Tool Test: FAIL - Tool factory method not found

Overall Status: FAIL

Tests completed for workflow run 20686026503.

AI generated by Smoke Copilot Playwright

github-actions · 2026-01-04T02:02:32Z

Smoke Test Results - Claude Engine

Last 2 Merged PRs:

Add default value to engine field in included_file_schema.json #8814: Add default value to engine field in included_file_schema.json
Add $comment validation documentation to stdio_mcp_tool in included schema #8813: Add $comment validation documentation to stdio_mcp_tool in included schema

Test Results:

✅ GitHub MCP (fetched PRs)
✅ File Writing (/tmp/gh-aw/agent/)
✅ Bash Tool (verified files)
✅ Playwright (navigated to GitHub, title verified)
✅ Cache Memory (/tmp/gh-aw/cache-memory/)
❌ Safe Input gh Tool (not available in environment)

Status: PASS (5/6 tests passed)

AI generated by Smoke Claude

github-actions · 2026-01-04T02:02:56Z

Recent merged PRs: #8814 Add default value to engine field in included_file_schema.json; #8813 Add $comment validation documentation to stdio_mcp_tool in included schema
GitHub MCP test ✅
Agent file write + cat ✅
Playwright title check ✅
Cache memory file ✅
safeinputs-gh issues list ❌ (command not found in environment)
Overall: FAIL

AI generated by Smoke Codex

Initial plan

2478d8c

Copilot AI assigned Copilot and pelikhan Jan 4, 2026

Copilot started work on behalf of pelikhan January 4, 2026 01:30 View session

Copilot AI and others added 3 commits January 4, 2026 01:38

Skip warnings for actions already pinned to full SHAs

6cf5bef

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Remove warnings for custom actions pinned to long sha~~ Skip warnings for actions already pinned to full SHAs Jan 4, 2026

Copilot AI requested a review from pelikhan January 4, 2026 01:53

Copilot finished work on behalf of pelikhan January 4, 2026 01:53

Copilot started work on behalf of pelikhan January 4, 2026 01:53 View session

pelikhan marked this pull request as ready for review January 4, 2026 01:59

pelikhan added the smoke label Jan 4, 2026

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

7ee5a16

Copilot finished work on behalf of pelikhan January 4, 2026 02:01

github-actions Bot added the smoke-copilot label Jan 4, 2026

github-actions Bot added the smoke-codex-firewall label Jan 4, 2026

github-actions Bot added the smoke-copilot-no-firewall label Jan 4, 2026

Add changeset [skip-ci]

84fe254

github-actions Bot added the smoke-claude label Jan 4, 2026

pelikhan merged commit e7f56d7 into main Jan 4, 2026
89 checks passed

pelikhan deleted the copilot/remove-custom-actions-warnings branch January 4, 2026 02:11

Conversation

Copilot AI commented Jan 4, 2026 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Behavior

I tried to connect to the following addresses, but was blocked by firewall rules:

Changeset

Uh oh!

pelikhan commented Jan 4, 2026

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited by agentic-workflows-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jan 4, 2026

Uh oh!

github-actions Bot commented Jan 4, 2026

Smoke Test Results: Copilot Safe Inputs

Uh oh!

github-actions Bot commented Jan 4, 2026

Copilot Smoke Test Results

Uh oh!

github-actions Bot commented Jan 4, 2026

Uh oh!

github-actions Bot commented Jan 4, 2026

Smoke Test Results - Copilot Engine (No Firewall)

Uh oh!

github-actions Bot commented Jan 4, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jan 4, 2026

Smoke Test Results - Claude Engine

Uh oh!

github-actions Bot commented Jan 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 4, 2026 •

edited by agentic-workflows-dev Bot

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited by agentic-workflows-dev Bot

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading

github-actions Bot commented Jan 4, 2026 •

edited

Loading