From 7747cde48619879d73a36ceacd756914c1e464fd Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 2 Jun 2026 13:47:26 +0000 Subject: [PATCH 1/3] Initial plan From 8af72d1d7fa46b47d727e7bdbc397ff58161df2c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 2 Jun 2026 13:58:43 +0000 Subject: [PATCH 2/3] Initial plan for fixing pull-request-target-checkout-false codemod Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/agentic-token-trend-audit.lock.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agentic-token-trend-audit.lock.yml b/.github/workflows/agentic-token-trend-audit.lock.yml index ffd520b54e8..4a0b2987612 100644 --- a/.github/workflows/agentic-token-trend-audit.lock.yml +++ b/.github/workflows/agentic-token-trend-audit.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"4a1d73e42e7ce64260e254e619ca70892901897d7783bcd4ad9e3d9dc2280a45","body_hash":"5ca969b895997c365652717787f8342fc4ffc07828e7a396633c38ebea38403b","strict":true,"agent_id":"copilot"} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"4a1d73e42e7ce64260e254e619ca70892901897d7783bcd4ad9e3d9dc2280a45","body_hash":"19c8b47e0c3545458752906fdc0ae7e3dad0be7b00b026573f67d31bce4b801f","strict":true,"agent_id":"copilot"} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-go","sha":"4a3601121dd01d1626a1e23e37211e3254c1c06c","version":"v6.4.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/setup-python","sha":"a309ff8b426b58ec0e2a45f0f869d46889d02405","version":"v6.2.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"docker/build-push-action","sha":"f9f3042f7e2789586610d6e8b85c8f03e5195baf","version":"v7.2.0"},{"repo":"docker/setup-buildx-action","sha":"d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5","version":"v4.1.0"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.58"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.58"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.58"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.22"},{"image":"ghcr.io/github/github-mcp-server:v1.1.0"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]} # ___ _ _ # / _ \ | | (_) From 031936ee9c6eb12d2e8ebbb7fc2a3c9849c08e8c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 2 Jun 2026 14:06:24 +0000 Subject: [PATCH 3/3] Fix: skip codemod when checkout is already a YAML mapping to prevent invalid YAML Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- ...emod_pull_request_target_checkout_false.go | 34 +++++++++++++++++++ ...pull_request_target_checkout_false_test.go | 26 ++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/pkg/cli/codemod_pull_request_target_checkout_false.go b/pkg/cli/codemod_pull_request_target_checkout_false.go index 6975a76b142..331da6551aa 100644 --- a/pkg/cli/codemod_pull_request_target_checkout_false.go +++ b/pkg/cli/codemod_pull_request_target_checkout_false.go @@ -27,6 +27,11 @@ func getPullRequestTargetCheckoutFalseCodemod() Codemod { return content, false, nil } + if isCheckoutMapping(frontmatter) { + pullRequestTargetCheckoutFalseCodemodLog.Print("Skipping pull_request_target checkout codemod: checkout is already a mapping with sub-keys") + return content, false, nil + } + if hasExplicitCheckoutCommands(content) { pullRequestTargetCheckoutFalseCodemodLog.Print("Skipping pull_request_target checkout codemod: explicit checkout command detected") return content, false, nil @@ -81,6 +86,19 @@ func isPullRequestTargetCheckoutDisabled(frontmatter map[string]any) bool { return ok && !checkoutDisabled } +// isCheckoutMapping returns true when the frontmatter "checkout" key is a YAML +// mapping (e.g. sparse-checkout:, fetch-depth:) rather than a scalar or absent. +// Overwriting a mapping with a scalar would orphan the child keys and produce +// invalid YAML, so callers should skip the codemod in this case. +func isCheckoutMapping(frontmatter map[string]any) bool { + checkoutAny, hasCheckout := frontmatter["checkout"] + if !hasCheckout { + return false + } + _, isMap := checkoutAny.(map[string]any) + return isMap +} + func hasExplicitCheckoutCommands(content string) bool { lowerContent := strings.ToLower(content) @@ -113,6 +131,22 @@ func ensureCheckoutFalseForPullRequestTarget(lines []string) ([]string, bool) { } if strings.HasPrefix(trimmed, "checkout:") { + // If the checkout line has no inline value, the next indented line + // would make this a YAML mapping block. Replacing it with a scalar + // would orphan those child keys and produce invalid YAML. + inlineValue := strings.TrimSpace(strings.TrimPrefix(trimmed, "checkout:")) + if inlineValue == "" { + for j := i + 1; j < len(lines); j++ { + next := lines[j] + if strings.TrimSpace(next) == "" { + continue + } + if len(next) > 0 && (next[0] == ' ' || next[0] == '\t') { + return lines, false + } + break + } + } checkoutLine, modified := normalizeCheckoutFalseLine(line) if !modified { return lines, false diff --git a/pkg/cli/codemod_pull_request_target_checkout_false_test.go b/pkg/cli/codemod_pull_request_target_checkout_false_test.go index 804cf68cc01..c904d1e5726 100644 --- a/pkg/cli/codemod_pull_request_target_checkout_false_test.go +++ b/pkg/cli/codemod_pull_request_target_checkout_false_test.go @@ -167,4 +167,30 @@ strict: false assert.False(t, applied, "codemod should not apply when strict is false") assert.Equal(t, content, result, "content should remain unchanged") }) + + t.Run("does not modify when checkout is a mapping with sub-keys", func(t *testing.T) { + content := `--- +description: "Review Azure SDK management-plane PRs" +on: + pull_request_target: +checkout: + sparse-checkout: | + .github +inlined-imports: true +--- +` + frontmatter := map[string]any{ + "on": map[string]any{ + "pull_request_target": map[string]any{}, + }, + "checkout": map[string]any{ + "sparse-checkout": ".github\n", + }, + } + + result, applied, err := codemod.Apply(content, frontmatter) + require.NoError(t, err, "codemod should not return an error") + assert.False(t, applied, "codemod should not apply when checkout is a mapping") + assert.Equal(t, content, result, "content should remain unchanged and not corrupt the mapping") + }) }