🔥 ข่าวด่วน: github/gh aw/pull/

pelikhan · 2026-10-25T04:05:39Z

Why

The prompt-tool scanner mistakes parenthesized prose such as file(s) and workflow(s) for MCP calls, and scans Dockerfile output examples as shell instructions. This produces six confirmed false-positive warnings across three workflows.

Approach

Recognize qualified tools at explicit invocation and tool-list positions instead of searching arbitrary prose. Stop at ambiguous (s) pluralization, including leading and comma-separated prose; explicit mcp__server__s remains supported.
Track complete fence delimiters and valid closing fences, including same-length nested examples in case-insensitively recognized Markdown output templates.
Add focused regressions for the reported prose and Dockerfile examples, explicit MCP lists, mixed-case templates, and real commands following artifact examples.

Tool permissions and configured transport checks are unchanged. This does not change checkout exemptions, template rendering, or other warning clusters.

ADR: ADR-71813: Anchor Prompt Tool Scanning to Invocation Positions

Validation

go test ./pkg/workflow -run '^TestPromptTool' -count=1 passed, including the review regressions and existing shell restriction and native/MCP transport checks.
make fmt passed.
The latest make agent-report-progress passed standard Go lint (zero issues), change-scoped custom lint, schema freshness, and impacted Go tests.
Compiled the three pinned corpus workflows with --no-emit: all succeeded and all six prompt-tool warnings disappeared; unrelated checkout warnings remain.
The complete gate is not green: the workflow-drift check compiled all 348 workflows successfully but reported the same 27 lock-file differences seen before the review fixes. Those files were restored and are not included in this PR.

Avoid treating parenthesized prose and nested Markdown artifact examples as required tools while preserving explicit invocations and shell tasks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-10-25T04:07:34Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~8 AIC · ⌖ ~6 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #71813

github-actions · 2026-10-25T04:07:35Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-25T04:07:36Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · ~14 AIC · ⌖ ~16 AIC · ◇ ~5 AIC · ⊞ 12.7K · ◷

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-25T04:07:37Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Commit pushed: b74f294

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-25T04:07:40Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-25T04:13:10Z

🏗️ Design Decision Gate — ADR Required

This PR adds 105 new lines under pkg/, which crosses the 100-line threshold for core business logic. It does not link an Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/71813-anchor-prompt-tool-scanning-to-invocation-positions.md. Please review and complete it before merging.

The draft records the decision to match qualified tool references (mcp__x__y / server(tool)) only at invocation and explicit tool-list positions, and to track complete fence delimiters, including nested same-length fences in markdown templates. The main trade-off: a qualified reference in the middle of a sentence is no longer detected.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

Review the draft ADR committed to your branch. It was generated from the PR diff.
Fill in what the draft could not infer, especially the [TODO: verify] items: deciders, and whether a parser-based approach (for example, goldmark) was evaluated.
Commit the finalized ADR to docs/adr/ on your branch.
Reference the ADR in this PR body by adding a line such as:

ADR: ADR-71813: Anchor Prompt Tool Scanning to Invocation Positions

Once an ADR is linked in the PR body, this gate will re-run and check that the implementation matches the decision.

❓ Why ADRs Matter

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors, and your future self, can find the reasoning behind a design.

📋 Michael Nygard ADR Format Reference

Context: What is the problem? What forces are at play?
Decision: What did you decide? Why?
Alternatives Considered: What else could have been done?
Consequences: What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus55 · ~26 AIC · ⌖ ~36 AIC · ⊞ 1.9K · ◷
_{Comment /review to run again}

github-actions · 2026-10-25T04:16:26Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-25T04:14:00Z
review_event: COMMENT
top_themes:
  - qualified-tool scanner still misclassifies leading or comma-separated prose plurals such as file(s)/workflow(s)
files_reviewed:
  - pkg/workflow/prompt_tool_validation.go
  - pkg/workflow/prompt_tool_validation_test.go
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~5 AIC · ⌖ ~1 AIC · ⊞ 1.6K · ◷
_{Comment /review to run again}

github-actions

Review: non-blocking issue

The scanner improvements are generally focused, but the anchored qualified-tool matcher still misclassifies leading or comma-separated prose plurals such as file(s) and workflow(s). I left one inline comment with the regression cases to cover.

Details

One medium-severity false-positive risk remains in the exact problem area this change is intended to address.
No blocking correctness, concurrency, or security issue was established from the changed lines.
The specialist pass completed; its additional fence concern conflicts with the intentional nested-fence behavior covered by the new tests and was not retained.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~5 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd (confirmed via pr-triage) — requesting changes on a reproducible regression in the new list-separator parsing.

📋 Key Themes & Highlights

Key Themes

Reintroduced false positive: The new promptToolListSeparator loop in promptQualifiedRequirements fixes the targeted file(s)/workflow(s) cases when they trail a single qualified tool, but reintroduces a spurious match when such prose follows a comma/conjunction inside a multi-tool list (e.g. "Use github(issue_read), workflow(s) to update." → incorrectly reports {server: workflow, tool: s}). Verified by direct repro against promptToolRequirements.
Minor robustness gap: markdownFence detection for the new nested-fence tracking only matches lowercase markdown/md info strings; mixed-case fences (```Markdown) won't engage the nested-fence guard. Low risk but worth normalizing and covering with a test.

Positive Highlights

✅ Anchoring promptQualifiedTool to the start of target is a clean, well-targeted fix for the original prose false positives (file(s), workflow(s) trailing a single tool reference).
✅ isClosingCodeFence reuse plus the new nestedFence state cleanly handles same-length nested fences in Markdown output templates — verified against the Dockerfile/artifact scenarios in the PR description.
✅ Strong regression test coverage for the original bug reports, including long/tilde fence variants and multi-tool qualified lists.
✅ All existing TestPromptTool* tests still pass; scope is well-contained to the scanner module.

See inline comments for the reproducible regression and the suggested fix/test. Everything else in this PR looks solid — happy to re-review once the list-separator edge case is addressed.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~79 AIC · ⌖ ~16 AIC · ⊞ 10.2K
_{Comment /matt to run again}

Copilot

🟡 Changes recommended

Targeted checks confirmed scanner regressions that can suppress required-tool warnings and misclassify template content.

2 open issues

Make list-separator parsing case-insensitive · New
Handle nested fences in non-Markdown templates · New

What changed in this PR

This PR refines gh-aw’s advisory prompt-tool scanner to reduce false warnings from parenthesized prose and fenced output examples, without changing tool permissions or transport checks.

Changes:

Restrict qualified MCP tool detection to invocation targets and explicit lists.
Track full fence delimiters, valid closing fences, and nested Markdown examples.
Add focused regression tests and document the design trade-offs.

File	Description
`pkg/workflow/prompt_tool_validation.go`	Refines tool-reference matching and fence-state tracking.
`pkg/workflow/prompt_tool_validation_test.go`	Adds coverage for prose, tool lists, and artifact examples.
`docs/adr/71813-anchor-prompt-tool-scanning-to-invocation-positions.md`	Records the scanner design, alternatives, and limitations.

_{Review effort: Max}

Stop qualified tool lists at ambiguous plural prose, recognize mixed-case Markdown templates, add regressions, and complete the scanner ADR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan · 2026-10-25T04:34:02Z

Acknowledged the Ponytail Reviewer completion. This status notice requests no independent code change; the actionable scanner feedback is addressed separately, with focused regression coverage.

pelikhan · 2026-10-25T04:34:03Z

Acknowledged the code-quality review completion. I accepted its associated inline finding and fixed leading and comma-separated plural prose with regression tests.

pelikhan · 2026-10-25T04:34:05Z

Acknowledged the Test Quality Sentinel completion. The notice itself needs no implementation change; this batch adds regressions for plural-list boundaries and mixed-case Markdown templates.

pelikhan · 2026-10-25T04:34:07Z

Acknowledged the generated ADR commit. I reviewed and completed that existing record rather than creating another ADR, and linked it in the PR description.

pelikhan · 2026-10-25T04:34:08Z

Accepted the actionable findings associated with the skills-review completion. Both the plural-list regression and mixed-case Markdown handling are fixed and covered by focused tests.

pelikhan · 2026-10-25T04:34:10Z

Accepted the ADR follow-up. I completed the existing record, removed verification placeholders without inventing parser experiments or reviewer acceptance, documented the additional plural/casing decisions, and linked the ADR in the PR body; its status remains Draft pending reviewer acceptance.

pelikhan · 2026-10-25T04:34:12Z

The theme in the managed review-memory comment is addressed by the plural-prose and list-boundary fix with regressions. I left the managed memory block and workflow metadata unchanged.

Recognize uppercase conjunctions without changing tool-name casing and track nested examples in all non-executable fences. Add regressions for denied alternatives and the cited workflow templates, and align the ADR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan · 2026-10-25T04:46:44Z

No additional change is required by this Ponytail completion notice. The new batch addresses the two separate actionable scanner findings.

pelikhan · 2026-10-25T04:46:46Z

The code-quality review notice is already addressed by the plural-prose fix from the previous batch. No duplicate implementation is needed.

pelikhan · 2026-10-25T04:46:48Z

This test-analysis completion notice adds no new requested change. The current batch adds focused coverage for uppercase tool alternatives and non-Markdown output templates.

pelikhan · 2026-10-25T04:46:49Z

The generated ADR notice remains satisfied by the completed existing record and its PR-body link. No second ADR is needed.

pelikhan · 2026-10-25T04:46:51Z

The findings associated with this skills-review notice were fixed in the previous batch. The new fixes preserve the plural boundary and mixed-case template regressions.

pelikhan · 2026-10-25T04:46:52Z

This ADR request is already satisfied: the existing record has no verification placeholders and is linked in the PR body. I updated its scanner decision for the current batch without claiming reviewer acceptance.

pelikhan · 2026-10-25T04:51:58Z

For this comment: No code change is needed: this is a completion notice or an acknowledgment of that notice, not a new defect report. The actionable scanner findings were handled separately.

pelikhan · 2026-10-25T04:51:59Z

For this comment: No code change is needed: this is a completion notice or an acknowledgment of that notice, not a new defect report. The actionable scanner findings were handled separately.

pelikhan · 2026-10-25T04:52:01Z

For this comment: No code change is needed: this is a completion notice or an acknowledgment of that notice, not a new defect report. The actionable scanner findings were handled separately.

pelikhan · 2026-10-25T04:52:02Z

For this comment: Already addressed: the associated plural-prose and tool-list finding was fixed with regression coverage. This completion notice or acknowledgment adds no new implementation request.

pelikhan · 2026-10-25T04:52:04Z

For this comment: Already addressed: the associated plural-prose and tool-list finding was fixed with regression coverage. This completion notice or acknowledgment adds no new implementation request.

pelikhan · 2026-10-25T04:52:05Z

For this comment: Already addressed: the associated plural-prose and tool-list finding was fixed with regression coverage. This completion notice or acknowledgment adds no new implementation request.

pelikhan · 2026-10-25T04:52:07Z

For this comment: Already addressed: the associated plural-prose and tool-list finding was fixed with regression coverage. This completion notice or acknowledgment adds no new implementation request.

pelikhan · 2026-10-25T04:52:09Z

For this comment: No additional change is needed for this test-review notice or its acknowledgment. The reported scanner edge cases already have focused regression coverage.

pelikhan · 2026-10-25T04:52:11Z

For this comment: No additional change is needed for this test-review notice or its acknowledgment. The reported scanner edge cases already have focused regression coverage.

pelikhan · 2026-10-25T04:52:12Z

For this comment: No additional change is needed for this test-review notice or its acknowledgment. The reported scanner edge cases already have focused regression coverage.

pelikhan · 2026-10-25T04:52:14Z

For this comment: No additional change is needed for this test-review notice or its acknowledgment. The reported scanner edge cases already have focused regression coverage.

pelikhan · 2026-10-25T04:52:16Z

For this comment: Already satisfied: the generated ADR was completed in place and linked in the PR description. This notice or acknowledgment does not require another ADR or commit.

pelikhan · 2026-10-25T04:52:18Z

For this comment: Already satisfied: the generated ADR was completed in place and linked in the PR description. This notice or acknowledgment does not require another ADR or commit.

pelikhan · 2026-10-25T04:52:19Z

For this comment: Already satisfied: the generated ADR was completed in place and linked in the PR description. This notice or acknowledgment does not require another ADR or commit.

pelikhan · 2026-10-25T04:52:21Z

For this comment: Already satisfied: the generated ADR was completed in place and linked in the PR description. This notice or acknowledgment does not require another ADR or commit.

pelikhan · 2026-10-25T04:52:23Z

For this comment: Already addressed: the skills review's plural-list and template-casing findings were fixed and covered by tests. This completion notice or acknowledgment contains no new requested change.

pelikhan · 2026-10-25T04:52:24Z

For this comment: Already addressed: the skills review's plural-list and template-casing findings were fixed and covered by tests. This completion notice or acknowledgment contains no new requested change.

pelikhan · 2026-10-25T04:52:26Z

For this comment: Already addressed: the skills review's plural-list and template-casing findings were fixed and covered by tests. This completion notice or acknowledgment contains no new requested change.

pelikhan · 2026-10-25T04:52:27Z

For this comment: Already addressed: the skills review's plural-list and template-casing findings were fixed and covered by tests. This completion notice or acknowledgment contains no new requested change.

pelikhan · 2026-10-25T04:52:29Z

For this comment: Already satisfied: ADR-71813 has no verification placeholders, records the current scanner decisions, and is linked in the PR body. It remains Draft pending reviewer acceptance; no duplicate record or acceptance claim is warranted.

pelikhan · 2026-10-25T04:52:31Z

For this comment: Already satisfied: ADR-71813 has no verification placeholders, records the current scanner decisions, and is linked in the PR body. It remains Draft pending reviewer acceptance; no duplicate record or acceptance claim is warranted.

pelikhan · 2026-10-25T04:52:33Z

For this comment: Already satisfied: ADR-71813 has no verification placeholders, records the current scanner decisions, and is linked in the PR body. It remains Draft pending reviewer acceptance; no duplicate record or acceptance claim is warranted.

pelikhan · 2026-10-25T04:52:35Z

For this comment: Already satisfied: ADR-71813 has no verification placeholders, records the current scanner decisions, and is linked in the PR body. It remains Draft pending reviewer acceptance; no duplicate record or acceptance claim is warranted.

pelikhan · 2026-10-25T04:52:36Z

For this comment: Already addressed: plural prose is excluded from qualified-tool lists with regression coverage. The managed review-memory block and workflow metadata remain unchanged.

pelikhan · 2026-10-25T04:52:38Z

For this comment: Already addressed: plural prose is excluded from qualified-tool lists with regression coverage. The managed review-memory block and workflow metadata remain unchanged.

pelikhan · 2026-10-25T04:52:40Z

For this comment: Already addressed: plural prose is excluded from qualified-tool lists with regression coverage. The managed review-memory block and workflow metadata remain unchanged.

pelikhan · 2026-10-25T04:52:41Z

For this comment: Already addressed: plural prose is excluded from qualified-tool lists with regression coverage. The managed review-memory block and workflow metadata remain unchanged.

github-actions · 2026-10-25T06:43:35Z

🎉 This pull request is included in a new release.

Release: v0.93.4

fix(workflow): narrow prompt tool invocation scanning

2781af3

Avoid treating parenthesized prose and nested Markdown artifact examples as required tools while preserving explicit invocations and shell tasks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan marked this pull request as ready for review October 25, 2026 04:06

Copilot AI max review requested due to automatic review settings October 25, 2026 04:06

Copilot started reviewing on behalf of pelikhan October 25, 2026 04:07

View session

docs(adr): add draft ADR-71813 for prompt tool scanner anchoring

b74f294

github-actions Bot reviewed Oct 25, 2026

View reviewed changes

Comment thread pkg/workflow/prompt_tool_validation.go

github-actions Bot previously requested changes Oct 25, 2026

View reviewed changes

Comment thread pkg/workflow/prompt_tool_validation.go

Comment thread pkg/workflow/prompt_tool_validation.go Outdated

Copilot AI reviewed Oct 25, 2026

View reviewed changes

Comment thread pkg/workflow/prompt_tool_validation.go Outdated

Comment thread pkg/workflow/prompt_tool_validation.go Outdated

fix(workflow): address prompt scanner review edge cases

003fa5f

Stop qualified tool lists at ambiguous plural prose, recognize mixed-case Markdown templates, add regressions, and complete the scanner ADR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan merged commit 9bd1376 into main Oct 25, 2026
54 checks passed

pelikhan deleted the pelikhan-musical-disco branch October 25, 2026 04:53

Conversation

pelikhan commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Approach

Validation

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026

🏗️ Design Decision Gate — ADR Required

Uh oh!

github-actions Bot commented Oct 25, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: non-blocking issue

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

Uh oh!

pelikhan commented Oct 25, 2026

pelikhan commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading