Repository navigation
Upgrade Copilot CLI to 1.0.103 with reviewed checksum pin - #72099
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
/smoke-copilot |
|
📰 BREAKING: Smoke Copilot is now investigating this issue comment. Sources say the story is developing... |
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review: no blocking findings
The changes are a consistent Copilot CLI 1.0.103 pin/checksum update with matching installer, integrity, compatibility, documentation, and regression-test updates. I found no actionable correctness or security issue on the changed lines. Static review only; tests were not run. The specialist pass was unavailable because its file-read attempt was denied, so this conclusion is based on the independent diff review.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K
Comment /review to run again
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /tdd — no actionable issues found; approving.
📋 Analysis
This is a mechanical, well-disciplined version bump (Copilot CLI 1.0.101 → 1.0.103) with the checksum-pin review process followed correctly:
pkg/constants/version_constants.goupdates bothDefaultCopilotVersionandDefaultCopilotChecksumsSHA256together, with a dated review comment referencing the authenticated GitHub API asset metadata (asset 666400170), matching existingscripts/update-release-pins.sh/scripts/update-copilot-version.shconventions.- The new pin is added to the
release_artifact_sha256table inactions/setup/sh/release_integrity.shalongside the retained older pins (1.0.98, 1.0.101), preserving fallback compatibility. - Test coverage was updated consistently across every affected layer:
release_integrity_test.sh(installer + compat fallback behavior, correctly bumping the compat-boundary edge case from 1.0.102→1.0.104 to stay above the new default),pkg/cli/install_copilot_cli_test.go(musl cache fixture URLs/manifest),pkg/constants/version_constants_test.go(new dedicated checksum regression test),pkg/constants/spec_test.go, andscripts/update-copilot-version_test.sh(idempotent update + re-run no-op check). .github/aw/compat.jsonand docs (copilot.md) were updated in lockstep with the new ceiling/default.- Ran
scripts/update-copilot-version_test.sh,actions/setup/sh/release_integrity_test.sh, and the related Go tests (pkg/cli,pkg/constants) locally — all pass.
I could not independently re-verify the SHA256 against api.github.com from this sandbox (network egress to the GitHub API is blocked here), so that specific authenticity claim relies on the author's stated review process — this matches the existing trust model for this repo (pins are reviewed by maintainers, not re-derived by CI).
Positive Highlights
- ✅ Version and checksum constants are updated atomically, preventing a split-brain state.
- ✅ Regression test explicitly pins the expected checksum (
TestDefaultCopilotChecksumsSHA256), guarding against silent future drift. - ✅ Compatibility-boundary test values were correctly adjusted to remain meaningful after the default version changed.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~53 AIC · ⌖ ~18 AIC · ⊞ 10.2K
Comment /matt to run again
|
Smoke partial: sub-agent ✅, merged PRs ✅, curl ✅, file ✅, rest not run. Overall: FAIL (partial).
|
There was a problem hiding this comment.
🔵 Needs a closer look
The supply-chain pin and broad workflow rollout require human sign-off because runtime and complete-rollout validation remain unconfirmed.
No open issues 🎉
What changed in this PR
Upgrades gh-aw’s default Copilot CLI from 1.0.101 to 1.0.103, addressing #72019 with a reviewed checksum-manifest pin.
Changes:
- Adds the v1.0.103 manifest pin while retaining older release pins.
- Synchronizes compiler defaults, installer fallback, compatibility ceiling, and generated workflow references.
- Updates regression coverage for checksum selection, updater idempotence, and compatibility fallback, plus documentation.
Non-blocking nit: In pkg/constants/version_constants.go:46, the provenance note remains unchanged when the updater replaces the checksum. Explicitly scope it to v1.0.103, preserve it alongside historical pins, or refresh/remove it during updates.
The recorded checksum and asset ID match GitHub release metadata. Tests, compilation, scanners, and runtime compatibility checks were not run; the complete reported 224-lock rollout was not independently verified.
| File | Description |
|---|---|
scripts/update-copilot-version_test.sh |
Tests the new version/checksum pair and idempotent updates. |
pkg/constants/version_constants.go |
Updates defaults and adds provenance with the nit noted above. |
pkg/constants/version_constants_test.go |
Checks the new version and manifest digest. |
pkg/constants/spec_test.go |
Updates the expected default version. |
pkg/cli/install_copilot_cli_test.go |
Updates musl installation fixtures and assertions. |
docs/src/content/docs/reference/engines/copilot.md |
Documents the new default. |
actions/setup/sh/release_integrity.sh |
Adds the reviewed manifest pin. |
actions/setup/sh/release_integrity_test.sh |
Updates pin and compatibility-fallback assertions. |
actions/setup/sh/install_copilot_cli.sh |
Updates the baked-in fallback version. |
.github/workflows/workflow-skill-extractor.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/windows.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/weekly-safe-outputs-spec-review.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/weekly-network-domains-audit.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/weekly-issue-summary.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/video-analyzer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/update-astro.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/unbloat-docs.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/uk-ai-operational-resilience.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/terminal-stylist.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/super-linter.lock.yml |
Updates the installer pin and detection-engine metadata. |
.github/workflows/sub-issue-closer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/stale-repo-identifier.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/squad-game-planner.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/smoke-work-queue.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/smoke-work-queue-worker.lock.yml |
Updates the installer pin and version metadata. |
.github/workflows/smoke-work-queue-dispatcher.lock.yml |
Updates the installer pin and version metadata. |
.github/workflows/smoke-test-tools.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-temporary-id.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-service-ports.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-pydantic.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-pi.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-pi-sub-agents.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-pi-routed.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-pi-routed-claude.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-otel-backends.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-opencode.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-kiro.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-issues.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/smoke-goose.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-github-claude.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-gemini.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-deepseek-harness.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-cursor.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-crush.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-claude-routed.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-claude-on-copilot.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/smoke-aider.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/sighthound-security-scan.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/schema-feature-coverage.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/research.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/repo-tree-map.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/repo-audit-analyzer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/refactoring-cadence.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/purelock.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/pr-sous-chef.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/poem-bot.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/objective-impact-report.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/necromancer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/metrics-collector.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/issue-triage-agent.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/issue-monster.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/grumpy-reviewer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/github-remote-mcp-auth-test.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/front-page-copy-guard.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/firewall.lock.yml |
Updates the installer pin and version metadata. |
.github/workflows/eslint-monster.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/eslint-factory-dispatcher.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/engine-conformance-copilot.lock.yml |
Updates the installer pin and version metadata. |
.github/workflows/duplicate-code-detector.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/design-decision-gate.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/dependabot-go-checker.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-work-queues-report.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-windows-defender-scan.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-token-consumption-report.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-team-status.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-team-evolution-insights.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-spending-forecast.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-spec-coverage-kiro.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-security-red-team.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-schema-audit-cursor.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-repo-chronicle.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-regulatory.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-regression-audit-kiro.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-pr-review-cursor.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/daily-performance-summary.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-news.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-multi-device-docs-tester.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-hippo-learn.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-go-test-stubs-aider.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-go-test-parallelizer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-function-namer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-evals-report.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-doc-updater.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-credit-limit-test.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-code-debt-aider.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-cli-performance.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/daily-byok-ollama-test.lock.yml |
Updates the installer pin and version metadata. |
.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/copilot-centralization-optimizer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/commit-changes-analyzer.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/cloclo.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/cli-version-checker.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/changeset.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/aw-issue-clustering.lock.yml |
Updates installer pins and version metadata. |
.github/workflows/audit-workflows.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/api-consumption-report.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/agentic-token-trend-audit.lock.yml |
Updates the installer version/checksum pair. |
.github/workflows/agent-persona-explorer.lock.yml |
Updates the installer pin and detection-engine metadata. |
.github/aw/compat.json |
Raises the Copilot compatibility ceiling to 1.0.103. |
Review effort: Max
|
🎉 This pull request is included in a new release. Release: |
Copilot CLI 1.0.103 requires a reviewed checksum-manifest pin before replacing the 1.0.101 default.
SHA256SUMS.txtpin from authenticated GitHub API asset metadata, cross-checked against the download. Record the mutable asset’s ID and review date; retain older pins.