Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
|
merge main add optional field safe-outputs.max-bot-mentions to configure maximum.
|
…ering Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Update neutralizeBotTriggers to allow 10 references
neutralizeBotTriggers: allow up to 10 references before filtering, skip already-quoted entries
Feb 22, 2026
…lize-bot-triggers
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in db29fe4:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
neutralizeBotTriggers: allow up to 10 references before filtering, skip already-quoted entries
neutralizeBotTriggers: allow up to 10 references before filtering, skip already-quoted entries, configurable via safe-outputs.max-bot-mentions
Feb 22, 2026
pelikhan
approved these changes
Feb 22, 2026
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Adjusts neutralizeBotTriggers so that common GitHub “autoclose” phrases (e.g., fixes #123) are only neutralized when they appear excessively, and adds a workflow-level knob to configure that threshold.
Changes:
- Update bot-trigger neutralization to apply only when there are >10 unquoted trigger references, and avoid re-quoting already backticked entries.
- Add optional
safe-outputs.max-bot-mentions(integer or${{ ... }}expression) to control the threshold from workflow config. - Wire the new setting through Go config extraction/generation into runtime JS, and update tests accordingly.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/safe_outputs_config_generation.go | Emits max_bot_mentions into the generated safe-outputs config JSON when configured. |
| pkg/workflow/safe_outputs_config.go | Extracts safe-outputs.max-bot-mentions as a templatable integer string. |
| pkg/workflow/compiler_types.go | Adds MaxBotMentions to SafeOutputsConfig. |
| pkg/parser/schemas/main_workflow_schema.json | Adds schema for safe-outputs.max-bot-mentions (integer or expression string). |
| actions/setup/js/sanitize_content_core.cjs | Implements thresholding + no-requote logic and exports the default constant. |
| actions/setup/js/sanitize_content.cjs | Adds maxBotMentions to sanitize options and forwards to core/neutralizer. |
| actions/setup/js/collect_ndjson_output.cjs | Parses max_bot_mentions from config and attempts to pass it into sanitization. |
| actions/setup/js/sanitize_content.test.cjs | Updates tests for ≤10 passthrough; adds >10 and no-requote coverage. |
| actions/setup/js/collect_ndjson_output.test.cjs | Updates expectations to reflect ≤10 passthrough behavior. |
| .changeset/patch-max-bot-mentions.md | Documents the new optional configuration field. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+199
to
+207
| core.info(`[INGESTION] Normalizing config keys (dash -> underscore)`); | ||
| expectedOutputTypes = Object.fromEntries(Object.entries(safeOutputsConfig).map(([key, value]) => [key.replace(/-/g, "_"), value])); | ||
| core.info(`[INGESTION] Expected output types after normalization: ${JSON.stringify(Object.keys(expectedOutputTypes))}`); | ||
| core.info(`[INGESTION] Expected output types full config: ${JSON.stringify(expectedOutputTypes)}`); | ||
| // Extract max-bot-mentions from config (defaults to undefined, using neutralizeBotTriggers default) | ||
| const rawMaxBotMentions = parseIntTemplatable(expectedOutputTypes.max_bot_mentions, 0); | ||
| if (rawMaxBotMentions > 0) { | ||
| maxBotMentions = rawMaxBotMentions; | ||
| } |
There was a problem hiding this comment.
After normalizing safeOutputsConfig into expectedOutputTypes, the new max_bot_mentions entry remains in the map and is treated as a valid output type (if (!expectedOutputTypes[itemType]) ...). This makes max_bot_mentions appear in “expected types” errors and allows an agent to emit type: max_bot_mentions items that bypass schema validation (since the config value is a number/string, not an inputs schema). Remove max_bot_mentions (and any other non-type/global keys) from expectedOutputTypes after extracting it, or keep global config in a separate object from the output-type map.
Contributor
|
@copilot apply comments |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 310e6f4. The 6 failures were in
|
Contributor
|
@copilot allow the first "n" occurrences then start escaping |
…ypes, pass maxBotMentions through validateItem Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Applied in 51eac11:
|
…threshold Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Copilot
AI
changed the title
neutralizeBotTriggers: allow up to 10 references before filtering, skip already-quoted entries, configurable via safe-outputs.max-bot-mentions
neutralizeBotTriggers: allow first n references unchanged then escape excess, skip already-quoted entries, configurable via safe-outputs.max-bot-mentions
Feb 22, 2026
Contributor
…tests for partial-escape behavior Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 2af039d. Two issues were addressed:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
github-actions bot
pushed a commit
that referenced
this pull request
Feb 22, 2026
- Add `max-bot-mentions` global safe-outputs option (from #17689) - Add Templatable Fields section covering expression support for max, expires, max-bot-mentions, and boolean fields (from #17653, #17667) - Update expires field description to note preferred string format - Document expires-integer-to-string codemod in gh aw fix (from #17695) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
safe-outputs.max-bot-mentionsoptional templatable integer fieldcompute_text.test.cjsandsanitize_output.test.cjsmax_bot_mentionsfromexpectedOutputTypesafter extracting it (prevents it being treated as a valid output type)maxBotMentionsthroughvalidateItem→validateField→sanitizeContentso the threshold is honored on the common validation pathValidateOptionstypedef insafe_output_type_validator.cjs, updatesanitize_content.test.cjstests for new partial-escape behaviorOriginal prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.