Enforce gh-aw v0.85.3 security compatibility floor by Copilot · Pull Request #55796 · github/gh-aw

Copilot · 2026-08-25T14:08:15Z

Updates the compatibility policy for GHSA-8h78-hpm7-29gg and adds reusable guidance for translating security advisories into targeted compatibility changes.

Changes

Compatibility enforcement
- Raises minimumVersion from v0.65.3 to v0.85.3.
- Preserves blocked, recommended, and agent compatibility policies.
Advisory workflow
- Adds security-advisory-compat-enforcer.
- Requires evidence-backed policy selection, monotonic version floors, schema validation, and preservation of unrelated fields.

"minimumVersion": "v0.85.3"

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-08-25T16:11:18Z

@copilot can you ban the range of releases flagged by the advisory?

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T16:21:05Z

@copilot can you ban the range of releases flagged by the advisory?

Addressed in 313ee1e: blockedVersions now enumerates every affected release from v0.82.8 through v0.85.2, while the general minimum remains v0.65.3.

pelikhan · 2026-08-25T16:43:49Z

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T16:50:10Z

@copilot v0.85.4 it's the first valid version that doesn't contain such a misreading of the advisory—or is the advisory…

Corrected in b435280: v0.85.3 is now blocked, so v0.85.4 is the first allowed release.

pelikhan · 2026-08-25T17:39:19Z

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the advisories

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T18:05:15Z

@copilot update the skill to make sure to run a schema validator on compat.json (there should be a task in main), also maintain a compat.md that lists why these versions are blocked linking to the adv...

Addressed in b3644de: the skill now requires the compatibility CI task plus Draft 7 schema validation, and .github/aw/compat.md documents the blocked v0.82.8–v0.85.3 range with the GHSA link.

pelikhan · 2026-08-25T20:14:07Z

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

pelikhan · 2026-08-25T20:16:54Z

@copilot the skill should tell the agent to provide remediation instructions, similarly to the advisory (see updated content in https://github.com/github/gh-aw/security/advisories/GHSA-8h78-hpm7-29gg)

Review the skill wording and habits and apply best practices from the security comunity, known CVE way of wording, specifying things.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-25T20:22:26Z

@copilot ensure that there is a unit test that validate that compat.json is valid w.r.t to the compat schema.

Addressed in e5e0922: added TestCompatJSONConformsToSchema, which compiles .github/aw/compat.schema.json and validates .github/aw/compat.json against it.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

gh-aw-bot · 2026-08-26T22:37:08Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers.
Revisit the open maintainer ask to fix the failing job and then run the pr-finisher skill.
Most recent maintainer instruction: Enforce gh-aw v0.85.3 security compatibility floor #55796 (comment)

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.03 AIC · ⌖ 8.03 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-26T22:46:39Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers....

Status update:

The technical concerns raised by the automated CHANGES_REQUESTED reviews (missing minRecommendedVersion bump, boundary tests, broken remediation link) were already addressed in b2d52b0 and replied to on each thread.
The minimumVersion vs blockedVersions semantics question was resolved per @pelikhan's explicit direction in this PR's history (ban the exact affected range, corrected to include v0.85.3): blockedVersions enumerates v0.82.8–v0.85.3, minimumVersion stays v0.65.3, minRecommendedVersion is now v0.85.4.
Fixed the failing job (https://github.com/github/gh-aw/actions/runs/32980123710/job/98215139311, TestFallbackAWFilesMatchesLocalAWDirectory) by adding compat.md to the embedded fallback file list.
Ran the full pr-finisher validation pass (make agent-report-progress, code_review, codeql_checker) — all pass clean with no new findings.

I don't have permissions to resolve GitHub review threads or edit the PR title/description directly from this environment — those need a maintainer action. All code-level asks are done and pushed.

gh-aw-bot · 2026-08-26T23:52:34Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers.
Please refresh the branch if needed and run the pr-finisher skill before handing back.
Recent automated review summary: Enforce gh-aw v0.85.3 security compatibility floor #55796

Generated by 👨🍳 PR Sous Chef

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 13.9 AIC · ⌖ 8.09 AIC · ⊞ 8.7K · ◷
_{Comment /souschef to run again}

…-json-to-0853 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-08-26T23:59:48Z

@copilot PR #55796 still needs follow-up.

Please address the outstanding requested-changes reviews from automated reviewers....

Refreshed the branch: merged 12 new commits from main (a6e0791), no conflicts, make agent-report-progress passes clean after the merge.

All actionable review feedback from automated reviewers was already addressed and replied to in prior commits (b2d52b0): minRecommendedVersion bumped to v0.85.4, boundary test added, broken remediation link fixed, and the minimumVersion/blockedVersions semantics question clarified per the maintainer's explicit direction earlier in this thread.

Remaining items (resolving GitHub review threads, editing the PR title/description) require repo-write actions this agent doesn't have access to in this sandbox — those need a maintainer.

github-actions · 2026-08-27T02:06:04Z

Category: chore; risk: high; score: 75/100 (impact 40/50, urgency 21/30, quality 14/20); recommended action: fast_track; CI: pending/unknown; review signal: 12 reviews, 26 issue comments.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 13.5 AIC · ⌖ 2.44 AIC · ⊞ 16.6K · ◷

done

github-actions · 2026-08-27T09:29:49Z

Generated by 🔧 PR Triage Agent · copilot · mai10 · 17.8 AIC · ⌖ 2.49 AIC · ⊞ 16.6K · ◷

pelikhan · 2026-08-27T20:20:02Z

@copilot revert the changes to compat.json and compat.md

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-27T20:28:03Z

@copilot revert the changes to compat.json and compat.md

Reverted in f9a1b93: .github/aw/compat.json is back to its pre-PR state (blockedVersions: [], minimumVersion/minRecommendedVersion at v0.65.3) and .github/aw/compat.md is deleted. Also regenerated the dependent SKILL.md index and fallback file list, and dropped the boundary test that asserted the now-reverted blocked range, to keep everything consistent.

github-actions · 2026-08-28T01:42:45Z

🎉 This pull request is included in a new release.

Release: v0.87.8

Enforce secure gh-aw compatibility floor

9ba74a6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Aug 25, 2026

Copilot finished work on behalf of pelikhan August 25, 2026 14:09

Copilot created this pull request from a session on behalf of pelikhan August 25, 2026 14:09 View session

Copilot AI requested a review from pelikhan August 25, 2026 14:09

Copilot started work on behalf of pelikhan August 25, 2026 16:11 View session

Ban advisory-affected gh-aw releases

313ee1e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 16:21

Copilot started work on behalf of pelikhan August 25, 2026 16:44 View session

Correct advisory release boundary

b435280

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 16:50

Copilot started work on behalf of pelikhan August 25, 2026 17:39 View session

Document blocked compatibility versions

b3644de

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 18:05

github-actions Bot mentioned this pull request Aug 25, 2026

[PR Triage Report] PR triage report: no eligible Copilot PRs due to cooldown #55842

Closed

Copilot started work on behalf of pelikhan August 25, 2026 20:14 View session

Test compat configuration schema validation

e5e0922

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 25, 2026 20:22

Copilot started work on behalf of pelikhan August 25, 2026 20:23 View session

Add advisory remediation guidance

1033341

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot started work on behalf of gh-aw-bot August 26, 2026 22:37 View session

Copilot finished work on behalf of gh-aw-bot August 26, 2026 22:47

Copilot AI requested a review from gh-aw-bot August 26, 2026 22:47

Copilot started work on behalf of gh-aw-bot August 26, 2026 23:52 View session

Merge remote-tracking branch 'origin/main' into copilot/update-combat…

a6e0791

…-json-to-0853 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot August 27, 2026 00:00

github-actions Bot mentioned this pull request Aug 27, 2026

[pr-sous-chef] PR Sous Chef run report #56159

Closed

github-actions Bot added pr-action:fast-track pr-priority:high pr-risk:high labels Aug 27, 2026

github-actions Bot mentioned this pull request Aug 27, 2026

[PR Triage Report] PR triage report - 2026-08-27 #56206

Closed

Merge branch 'main' into copilot/update-combat-json-to-0853

778f022

github-actions Bot mentioned this pull request Aug 27, 2026

[PR Triage Report] PR triage report for Copilot-authored PRs (2026-08-27) #56300

Closed

github-actions Bot added the pr-batch:permissions-security label Aug 27, 2026

Copilot started work on behalf of pelikhan August 27, 2026 20:20 View session

Revert compat.json and compat.md changes per maintainer request

2e2ca34

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 27, 2026 20:28

pelikhan merged commit ffd51ac into main Aug 27, 2026

pelikhan deleted the copilot/update-combat-json-to-0853 branch August 27, 2026 20:36

github-actions Bot mentioned this pull request Aug 28, 2026

Smoke Test: MAI-Code-1-Flash - 33138085041 #56476

Closed

Uh oh!

Conversation

Copilot AI commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

pelikhan commented Aug 25, 2026

Uh oh!

Copilot AI commented Aug 25, 2026

Uh oh!

gh-aw-bot commented Aug 26, 2026

Uh oh!

Copilot AI commented Aug 26, 2026

Uh oh!

gh-aw-bot commented Aug 26, 2026

Uh oh!

Copilot AI commented Aug 26, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

pelikhan commented Aug 27, 2026

Uh oh!

Copilot AI commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 25, 2026 •

edited

Loading