Skip to content

Add update_pull_request_branches maintenance operation with dedicated workflow job #28108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 13 commits into
base: main
Choose a base branch
from
+588 −7
Draft

Add update_pull_request_branches maintenance operation with dedicated workflow job #28108

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
81ac174
chore: plan update_pull_request_branches maintenance command
Copilot Apr 23, 2026
e6542a5
feat: add update_pull_request_branches maintenance operation
Copilot Apr 23, 2026
a003433
fix: clarify and enforce filtering to PRs without active sessions
Copilot Apr 23, 2026
649024c
chore: revert unrelated spec test artifact
Copilot Apr 23, 2026
b064a93
fix: use Copilot REST API for active session listing
Copilot Apr 23, 2026
69eacaa
chore: add core logging for session listing diagnostics
Copilot Apr 23, 2026
8f30fef
fix: improve core logging safety in session API errors
Copilot Apr 23, 2026
1507b7f
chore: refine logging helper diagnostics
Copilot Apr 23, 2026
6546f14
chore: harden error preview logging path
Copilot Apr 23, 2026
d71669e
fix: split update_pull_request_branches into dedicated maintenance job
Copilot Apr 23, 2026
c74ae15
test: ensure draft pull requests are excluded from branch updates
Copilot Apr 23, 2026
a40c8ae
fix: pass GH_TOKEN to maintenance admin-check API steps
Copilot Apr 23, 2026
d73f1e1
revert: undo GH_TOKEN env propagation in maintenance admin checks
Copilot Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 43 additions & 2 deletions .github/workflows/agentics-maintenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ on:
- 'activity_report'
- 'close_agentic_workflows_issues'
- 'clean_cache_memories'
- 'update_pull_request_branches'
- 'validate'
run_url:
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
Expand All @@ -62,7 +63,7 @@ on:
workflow_call:
inputs:
operation:
description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, validate)'
description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate)'
required: false
type: string
default: ''
Expand Down Expand Up @@ -157,7 +158,7 @@ jobs:
await main();

run_operation:
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'validate' && (!(github.event.repository.fork)) }}
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
permissions:
actions: write
Expand Down Expand Up @@ -213,6 +214,46 @@ jobs:
id: record
run: echo "operation=${{ inputs.operation }}" >> "$GITHUB_OUTPUT"

update_pull_request_branches:
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'update_pull_request_branches' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
permissions:
pull-requests: write
steps:
- name: Checkout actions folder
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
sparse-checkout: |
actions
persist-credentials: false

- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions

- name: Check admin/maintainer permissions
Copy link
Copy Markdown
Collaborator

@pelikhan pelikhan Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot pass the GitHub token to any step using GitHub APIs to avoid rate limiting, include admin check and logs download

Copy link
Copy Markdown
Contributor Author

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in a40c8ae: all maintenance Check admin/maintainer permissions github-script steps now receive GH_TOKEN in env, and the activity-report logs download step already passes GH_TOKEN. Added regression coverage in TestGenerateMaintenanceWorkflow_AdminCheckPassesGHTokenEnv to keep this enforced.

uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
await main();

- name: Update pull request branches
uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require('${{ runner.temp }}/gh-aw/actions/update_pull_request_branches.cjs');
await main();

apply_safe_outputs:
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
Expand Down
3 changes: 2 additions & 1 deletion actions/setup/js/run_operation_update_upgrade.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@ function formatTimestamp(date) {
}

/**
* Run 'gh aw update', 'gh aw upgrade', 'gh aw disable', or 'gh aw enable',
* Run maintenance operations handled by run_operation:
* - 'gh aw update', 'gh aw upgrade', 'gh aw disable', 'gh aw enable'
* creating a pull request when needed for update/upgrade operations.
*
* For update/upgrade: runs with --no-compile so lock files are not modified.
Expand Down
Loading
Loading