[review] feat: implement `private-to-public-flows: allow` as a `tools.github` frontmatter field by github-actions[bot] · Pull Request #45129 · github/gh-aw

github-actions · 2026-07-12T19:27:11Z

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Reason: agent_failure

Review the workflow run logs for details.

This PR contains changes that were originally intended for PR #45113 (copilot/implement-private-to-public-flows).
Please review the changes carefully before merging.

Generated by 👨‍🍳 PR Sous Chef · 8.27 AIC · ⌖ 6.32 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

…ield - Add `private-to-public-flows` to the workflow frontmatter JSON schema under `tools.github`, accepting either `"allow"` (blanket opt-out) or an array of server ID strings (selective exemption) - Add `PrivateToPublicFlows any` field to `GitHubToolConfig` struct - Parse `private-to-public-flows` in `parseGitHubTool` (string and []string/[]any forms) - Add `ForcePublicRepos *bool` and `SinkVisibilityExemptServers []string` to `MCPGatewayRuntimeConfig` - In `buildMCPGatewayConfig`, translate `PrivateToPublicFlows` to the gateway config fields - Emit `"forcePublicRepos": false` and `"sinkVisibilityExemptServers"` in the gateway JSON section of the renderer - Reject `private-to-public-flows: allow` in strict mode (list form allowed per MCP Gateway Spec Section 10.9.4) - Add documentation section to github-tools.md - Add tests: parsing, gateway config building, emission, strict mode Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

…date server IDs, fix shell safety, update docs Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

gh-aw-bot · 2026-07-12T20:07:05Z

@copilot please run the pr-finisher skill, review the PR state, and complete any remaining branch refresh or checks so maintainers can evaluate this follow-up PR quickly.

Generated by 👨‍🍳 PR Sous Chef · 18.8 AIC · ⌖ 7.66 AIC · ⊞ 4.2K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-12T20:22:59Z

@copilot please run the pr-finisher skill, review the PR state, and complete any remaining branch refresh or checks so maintainers can evaluate this follow-up PR quickly.

...

Done. I ran PR finisher actions: refreshed the branch from main and resolved the merge conflict, then ran local validation (make fmt, make lint, make test-unit, make test, make recompile, and make agent-report-progress). The update is in commit 9dfcaa3; PR mergeability is now clean. CI on this new HEAD is still unverified until a maintainer re-triggers workflows.

gh-aw-bot · 2026-07-12T20:33:40Z

@copilot please run the pr-finisher skill, review the PR state, and rerun checks once the branch is ready for maintainer review.

Generated by PR Sous Chef run https://github.com/github/gh-aw/actions/runs/29207618338

Generated by 👨‍🍳 PR Sous Chef · 11.8 AIC · ⌖ 6.23 AIC · ⊞ 4.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-12T20:46:00Z

@copilot please run the pr-finisher skill, review the PR state, and rerun checks once the branch is ready for maintainer review.

Generated by PR Sous Chef run https://github.com/github/gh-aw/acti...

Completed a second PR-finisher pass on current HEAD 9dfcaa3: PR is open/non-draft, mergeable clean, no unresolved review threads, and local checks rerun successfully (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress). CI checks on this HEAD still need a maintainer-triggered rerun (workflow_dispatch, close/reopen, or maintainer push).

gh-aw-bot · 2026-07-12T23:03:17Z

@copilot please run the pr-finisher skill, address unresolved review feedback, refresh the branch if needed, and rerun checks once updates are ready.

Generated by 👨‍🍳 PR Sous Chef · 4.05 AIC · ⌖ 7.38 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-12T23:14:48Z

@copilot please run the pr-finisher skill, address unresolved review feedback, refresh the branch if needed, and rerun checks once updates are ready.

...

Completed a PR-finisher pass on HEAD 9dfcaa3: there are no unresolved review threads, PR state is open/non-draft and mergeable clean, and local checks all passed (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress). I also reviewed recent workflow runs/logs; the referenced run 29205138163 is currently successful, while CI on the current head remains maintainer-triggered for fresh verification.

github-actions · 2026-07-13T01:25:06Z

Hey team 👋 — this auto-generated review PR for the private-to-public-flows: allow frontmatter feature adds a changeset entry (+5 lines) that was originally scoped to PR #45113. The change itself is well-targeted and focused.

A couple of things worth noting before merging:

Agentic threat flag — the PR body includes a gh-aw-threat-detected caution block with reason agent_failure. Manual review of the linked workflow run is required before any follow-up automation is triggered, per the inline notice.
No tests — the diff only adds .changeset/minor-private-to-public-flows.md. If the underlying implementation (in PR feat: implement private-to-public-flows: allow as a tools.github frontmatter field #45113 or its successor) doesn't yet have test coverage for the private-to-public-flows: allow flow, that should be addressed before this changeset is merged so the release entry accurately reflects a fully tested feature.

If you'd like an agent to help close the gap:

Add tests for the `private-to-public-flows: allow` field in the `tools.github` frontmatter.
Cover the following cases:
1. Workflow with `private-to-public-flows: allow` set — should permit the flow without error.
2. Workflow without the field — should use the default (deny) behaviour.
3. Invalid value (e.g. `private-to-public-flows: maybe`) — should return a validation error.
Place tests alongside the existing `tools.github` frontmatter tests.

Generated by ✅ Contribution Check · 115.3 AIC · ⌖ 9.07 AIC · ⊞ 6.2K · ◷

gh-aw-bot · 2026-07-13T02:56:27Z

pr-sous-chef
@copilot please run the pr-finisher skill, review the current PR state, address any remaining feedback, and rerun checks once the branch is ready for maintainer review.

Run: https://github.com/github/gh-aw/actions/runs/29220275355

Generated by 👨‍🍳 PR Sous Chef · 8.27 AIC · ⌖ 6.32 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

…view-1783884427946

Copilot · 2026-07-13T03:07:18Z

pr-sous-chef
@copilot please run the pr-finisher skill, review the current PR state, address any remaining feedback, and rerun checks once the branch is ready for maintainer review.
...

Completed another PR-finisher pass on HEAD 331153f: PR is open/non-draft and mergeable clean, with no unresolved review threads. I reran local checks successfully (make fmt, make lint, make test-unit, make test, make recompile, make agent-report-progress) and reviewed workflow run 29220275355 plus branch run logs; no failed jobs were reported there. CI on this HEAD remains maintainer-triggered for fresh verification before merge.

Copilot AI and others added 6 commits July 12, 2026 17:01

Initial plan

0f0a899

feat: address code review - improve warning message clarity

95bc57e

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Merge branch 'main' into copilot/implement-private-to-public-flows

1ee1ba3

fix: address code review - propagate allow into sink-visibility, vali…

f5fcfe9

…date server IDs, fix shell safety, update docs Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Add changeset

c6f1b44

github-actions Bot added the needs-review label Jul 12, 2026

This was referenced Jul 12, 2026

feat: implement private-to-public-flows: allow as a tools.github frontmatter field #45113

Merged

[aw] Smoke Copilot is missing required tool #45132

Closed

Base automatically changed from copilot/implement-private-to-public-flows to main July 12, 2026 20:01

github-actions Bot mentioned this pull request Jul 12, 2026

[pr-sous-chef] Run report — 2 nudged, 2 skipped #45016

Closed

Copilot started work on behalf of gh-aw-bot July 12, 2026 20:07 View session

Merge origin/main into copilot branch

9dfcaa3

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI requested a review from gh-aw-bot July 12, 2026 20:23

Copilot finished work on behalf of gh-aw-bot July 12, 2026 20:23

Copilot started work on behalf of gh-aw-bot July 12, 2026 20:33 View session

Copilot finished work on behalf of gh-aw-bot July 12, 2026 20:46

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request Jul 12, 2026

[Contribution Check Report] Contribution Check — 2026-07-12 #45028

Closed

Copilot started work on behalf of gh-aw-bot July 12, 2026 23:03 View session

Copilot finished work on behalf of gh-aw-bot July 12, 2026 23:15

This was referenced Jul 13, 2026

[Outcome Report] Outcome Collector Report — 2026-07-13 #45147

Open

[Contribution Check Report] Contribution Check — 2026-07-13 #45156

Closed

Merge branch 'main' into copilot/implement-private-to-public-flows-re…

331153f

…view-1783884427946

github-actions Bot mentioned this pull request Jul 13, 2026

[pr-sous-chef] Run report — 4 nudged, 0 skipped #45140

Closed

Copilot started work on behalf of gh-aw-bot July 13, 2026 02:56 View session

Copilot finished work on behalf of gh-aw-bot July 13, 2026 03:07

lpcox closed this Jul 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[review] feat: implement `private-to-public-flows: allow` as a `tools.github` frontmatter field#45129

[review] feat: implement `private-to-public-flows: allow` as a `tools.github` frontmatter field#45129
github-actions[bot] wants to merge 8 commits into
mainfrom
copilot/implement-private-to-public-flows-review-1783884427946

github-actions Bot commented Jul 12, 2026 •

edited

Loading

Uh oh!

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

This comment has been minimized.

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

gh-aw-bot commented Jul 13, 2026

Uh oh!

Copilot AI commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

This comment has been minimized.

gh-aw-bot commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

gh-aw-bot commented Jul 13, 2026

Uh oh!

Copilot AI commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jul 12, 2026 •

edited

Loading