maintenance: correct `tidy-fix` comment reactions, and aggressive consolidation by greenc-FNAL · Pull Request #411 · Framework-R-D/phlex

greenc-FNAL · 2026-03-11T18:12:42Z

Resolve issues with comment reactions for clang-tidy-fix workflow
Aggressive consolidation to reduce CLOC (-𝚫>500) and ease maintenance

PR created automatically by Jules for task 18132869807280577001 started by @greenc-FNAL

google-labs-jules · 2026-03-11T18:12:43Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

Copilot

Pull request overview

This PR consolidates PR-comment reaction handling for @phlexbot ...-fix workflows by introducing a reusable composite action that removes the initial “eyes” reaction and adds a completion reaction based on workflow outcome.

Changes:

Added a new composite action (complete-pr-comment) to centralize reaction cleanup + completion reactions.
Updated multiple fix workflows to call the new action (and to run it under always() so it executes on failures).
Added a completion job to clang-tidy-fix to ensure reactions are updated after tidy + PR-comment steps.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/yaml-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/python-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/markdown-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/jsonnet-format-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/header-guards-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/cmake-format-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/clang-format-fix.yaml	Replaces inline reaction github-script steps with `complete-pr-comment`.
.github/workflows/format-all.yaml	Uses `complete-pr-comment` with an aggregated status across sub-workflows.
.github/workflows/clang-tidy-fix.yaml	Adds a new job to update reactions for clang-tidy runs.
.github/actions/complete-pr-comment/action.yaml	New composite action implementing reaction removal + success/failure reaction.

Comments suppressed due to low confidence (1)

.github/actions/complete-pr-comment/action.yaml:53

This file appears to end with an extra blank line (trailing blank line at EOF). The repo’s formatting rules require files to end with exactly one newline and no trailing blank lines; please remove the final empty line.

You can also share your feedback on Copilot code review. Take the survey.

.github/actions/complete-pr-comment/action.yaml

.github/workflows/format-all.yaml

Copilot

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 8 comments.

You can also share your feedback on Copilot code review. Take the survey.

.github/workflows/codeql-analysis.yaml

.github/actions/prepare-check-outputs/action.yaml

.github/actions/prepare-fix-outputs/action.yaml

refactor.py

refactor_checks.py

final_verify.py

.github/workflows/clang-tidy-fix.yaml

greenc-FNAL · 2026-03-11T20:29:31Z

@phlexbot format

github-actions · 2026-03-11T20:30:21Z

Format Fixes Applied

✅ ruff fixes pushed (commit a02a65f)
✅ YAML formatter fixes pushed (commit 4c38572)

⚠️ Note: Some issues may require manual review and fixing.

greenc-FNAL · 2026-03-12T02:55:15Z

@phlexbot yaml-fix

github-actions · 2026-03-12T02:55:36Z

Automatic YAML formatter fixes pushed (commit 4b59517).
⚠️ Note: Some issues may require manual review and fixing.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@main

This commit introduces a new reusable GitHub Action `.github/actions/complete-pr-comment` to handle removing the 'eyes' reaction and adding a completion reaction ('rocket' for success, 'confused' for failure) to triggering issue comments. Changes: - Created `.github/actions/complete-pr-comment/action.yaml` with robust error handling. - Updated `clang-tidy-fix.yaml` to include reaction handling (fixing the reported issue). - Refactored all other format fix workflows to use the new consolidated action. - Improved `format-all.yaml` to report the aggregate status of all formatting sub-jobs. Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> maintenance: Consolidate workflow reactions and setup logic This commit introduces a major refactoring of the CI workflows to reduce duplication, improve maintainability, and ensure consistent PR comment reactions. New Reusable Actions: - .github/actions/complete-pr-comment: Robustly handles PR comment reactions (removing 'eyes', adding 'rocket' on success or 'confused' on failure) with proper error handling. - .github/actions/prepare-fix-outputs: Consolidates the resolution of branch and repository information for workflows triggered by bot commands. - .github/actions/prepare-check-outputs: Consolidates environment detection and ref resolution for check-style workflows. Improvements: - Fixed missing completion reactions in clang-tidy-fix. - Refactored all 21 core workflow files to use the new actions, significantly reducing duplicated boilerplate. - Preserved all original authorization triggers and permissions. - Enhanced format-all.yaml to report an aggregate status. - Consistently used @main for internal action references as requested. Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> maintenance: Fix and consolidate PR comment reactions and workflow setup This commit addresses the missing 'rocket' emoji on completion of fix workflows and performs a major refactoring of the CI workflows to reduce duplication and improve maintainability. Key Changes: - Created `.github/actions/complete-pr-comment`: Robustly handles PR comment reactions (removing 'eyes', adding 'rocket' on success or 'confused' on failure) with proper error handling. - Created `.github/actions/prepare-fix-outputs`: Consolidates ref and repository resolution for bot-triggered workflows. - Created `.github/actions/prepare-check-outputs`: Consolidates environment detection and ref resolution for check workflows. - Refactored all 21 core workflow files to use these new actions. - Fixed specific issues in `clang-tidy-fix.yaml`, `codeql-analysis.yaml`, and `format-all.yaml` identified during review. - Removed temporary refactoring scripts. These changes ensure consistent behavior and significantly reduce YAML boilerplate. Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> Apply YAML formatter fixes

.github/actions/run-change-detection/action.yaml

+    - name: Check out source code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        fetch-depth: 0
+        path: ${{ inputs.checkout-path }}
+        ref: ${{ inputs.ref }}
+        repository: ${{ inputs.repo }}
+
+    - name: Detect relevant changes


In general, to fix this class of problem you must ensure that untrusted pull-request code is not checked out (or, if it must be, not executed) in a privileged context. For a reusable composite action, the safest approach is to (a) constrain the repository and ref that can be checked out so that they are not directly controllable by PR authors, or (b) clearly separate “trusted” and “untrusted” modes, requiring an explicit, safe ref when used in privileged workflows.

For this specific file, the minimal change that hardens the action without altering intended functionality is to restrict repository to the current repository and eliminate the ability for callers to override repo arbitrarily. That removes a major injection vector where a privileged workflow could be tricked into checking out an attacker-controlled repository. Additionally, we can narrow the ref to only allow values that are expected to be trusted (for example defaulting to the workflow’s own ref) or at least document that ref must not be wired directly from untrusted PR HEAD in privileged workflows; however, we are constrained to code-only changes and cannot enforce patterns at the call site. Within this file, the best concrete hardening we can do is:

Remove repo as a configurable input for checkout and instead use repository: ${{ github.repository }} so the checkout is always from the current repo.

Optionally, we can leave the repo input defined for backward compatibility for callers, but it will no longer affect the checkout. This avoids breaking existing workflows while still preventing unexpected external repos from being checked out in a privileged job.

These edits are all within .github/actions/run-change-detection/action.yaml in the Check out source code step (lines 40–47). No new imports or external dependencies are needed.

greenc-FNAL · 2026-03-12T14:30:02Z

Review the full CodeQL report for details.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 20 comments.

Comments suppressed due to low confidence (1)

.github/workflows/jsonnet-format-fix.yaml:112

The Jsonnet formatting step still uses CHECKOUT_PATH: ${{ env.local_checkout_path }}, but checkout now happens at ${{ needs.setup.outputs.checkout_path }}. These can diverge when inputs.repo points at a different repo name than github.event.repository.name (or when workflow-setup resolves a different default), causing find "$CHECKOUT_PATH" ... to operate on a non-existent directory and apply no fixes. Use ${{ needs.setup.outputs.checkout_path }} consistently for CHECKOUT_PATH.

      - name: Apply Jsonnet formatting
        id: lint
        env:
          CHECKOUT_PATH: ${{ env.local_checkout_path }}
        # yamllint disable rule:line-length
        run: |
          docker run --rm -v "${{ github.workspace }}:/work" -w /work --user root public.ecr.aws/bitnami/jsonnet:latest \
            sh -c "find \"$CHECKOUT_PATH\" \( -name '*.jsonnet' -o -name '*.libsonnet' \) -print0 | xargs -0 -r jsonnetfmt -i"

You can also share your feedback on Copilot code review. Take the survey.

.github/workflows/markdown-fix.yaml

.github/workflows/jsonnet-format-fix.yaml

.github/workflows/cmake-format-fix.yaml

.github/workflows/actionlint-check.yaml

.github/workflows/header-guards-check.yaml

.github/actions/workflow-setup/action.yaml

.github/workflows/clang-tidy-fix.yaml

.github/workflows/header-guards-fix.yaml

.github/workflows/yaml-fix.yaml

.github/workflows/clang-tidy-check.yaml

greenc-FNAL · 2026-03-12T14:53:00Z

@copilot Please address all outstanding current and historical review comments in the following ways:

Resolve all "outdated" review comments.
Resolve all historical review comments addressed or obsoleted by subsequent commits.
Resolve with an appropriate note all comments mentioning the security/safety of reusable action version/branch/hash specifications, as these will be changed to @main per policy prior to merge.
Evaluate all remaining outstanding review comments for validity of criticism, and then address and.or resolve with an appropriate note

Copilot · 2026-03-12T14:53:09Z

@greenc-FNAL I've opened a new pull request, #414, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 5 comments.

You can also share your feedback on Copilot code review. Take the survey.

.github/actions/post-clang-tidy-results/action.yaml

.github/workflows/format-all.yaml

.github/workflows/yaml-check.yaml

.github/workflows/format-all.yaml

.github/actions/workflow-setup/action.yaml

greenc-FNAL · 2026-03-12T19:20:12Z

@copilot Please address outstanding, unresolved review comments from the latest review.

Copilot · 2026-03-12T19:20:22Z

@greenc-FNAL I've opened a new pull request, #419, to work on those changes. Once the pull request is ready, I'll request review from you.

…sion (#419) * Initial plan * Fix artifact nested path and add issues:write permission for reactions Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 19 comments.

You can also share your feedback on Copilot code review. Take the survey.

.github/actions/post-clang-tidy-results/action.yaml

.github/workflows/python-check.yaml

.github/workflows/clang-format-check.yaml

.github/workflows/actionlint-check.yaml

.github/workflows/yaml-check.yaml

.github/actions/complete-pr-comment/action.yaml

.github/workflows/clang-tidy-check.yaml

.github/workflows/cmake-build.yaml

.github/workflows/yaml-fix.yaml

.github/workflows/cmake-format-fix.yaml

greenc-FNAL · 2026-03-12T19:40:00Z

@copilot Please address current unresolved review comments, excepting any that refer to changing the branch/version/hash reference to any reusable actions. Pay special attention to careful analysis and resolution of possible workflow permission issues.

Copilot · 2026-03-12T19:40:11Z

@greenc-FNAL I've opened a new pull request, #420, to work on those changes. Once the pull request is ready, I'll request review from you.

* Initial plan * fix: address unresolved review comments - permissions, workflow_dispatch, pr-head-sha wiring Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 8 comments.

You can also share your feedback on Copilot code review. Take the survey.

.github/actions/workflow-setup/action.yaml

.github/workflows/python-check.yaml

.github/workflows/markdown-check.yaml

.github/workflows/jsonnet-format-check.yaml

.github/workflows/format-all.yaml

.github/workflows/clang-tidy-check.yaml

.github/workflows/cmake-format-check.yaml

.github/workflows/header-guards-check.yaml

greenc-FNAL · 2026-03-12T20:14:04Z

@copilot Please address unresolved comments from the latest review, but more generally I think we need to ensure that—for all workflows—relevance detection either runs as expected or is bypassed according to expectations from upstream/main. In addition, we need to be sure that trigger events of all types behave according to upstream/main's example, and we account properly for when the workflow is actually operating according to workflow_call, and when it is seeing the trigger event that the calling workflow saw.

It is of paramount importance that all workflow/action functionality from upstream/main will survive the merge of this PR.

Copilot · 2026-03-12T20:14:15Z

@greenc-FNAL I've opened a new pull request, #421, to work on those changes. Once the pull request is ready, I'll request review from you.

…d correct clang-tidy/format-all failure behavior (#421) * Initial plan * fix: wire workflow_call inputs, act fallback for change detection, and clang-tidy/format-all failures Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: greenc-FNAL <2372949+greenc-FNAL@users.noreply.github.com>

greenc-FNAL · 2026-03-12T20:26:21Z

@phlexbot yaml-fix

github-actions · 2026-03-12T20:26:43Z

Automatic YAML formatter fixes pushed (commit 333f6d3).
⚠️ Note: Some issues may require manual review and fixing.

greenc-FNAL · 2026-03-12T20:27:05Z

@phlexbot markdown-fix

github-actions · 2026-03-12T20:27:29Z

No automatic markdownlint fixes were necessary.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 20 comments.

You can also share your feedback on Copilot code review. Take the survey.

.github/workflows/yaml-fix.yaml

.github/workflows/markdown-fix.yaml

.github/workflows/clang-tidy-fix.yaml

.github/workflows/markdown-check.yaml

.github/workflows/python-fix.yaml

.github/workflows/jsonnet-format-fix.yaml

.github/workflows/clang-tidy-check.yaml

.github/workflows/actionlint-check.yaml

.github/workflows/coverage.yaml

.github/workflows/clang-tidy-check.yaml

Per #411 (comment)

greenc-FNAL · 2026-03-12T23:40:36Z

@knoepfel This was tested as much as possible with a temporary change to reusable action locations, which has been reverted for (hopefully) final review and merge.

greenc-FNAL requested review from aolivier23, knoepfel, marcpaterno and sabasehrish as code owners March 11, 2026 18:12

Copilot AI review requested due to automatic review settings March 11, 2026 18:12

Copilot started reviewing on behalf of greenc-FNAL March 11, 2026 18:13 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

.github/actions/complete-pr-comment/action.yaml Outdated Show resolved Hide resolved

.github/workflows/format-all.yaml Outdated Show resolved Hide resolved

greenc-FNAL requested a review from Copilot March 11, 2026 19:55

Copilot started reviewing on behalf of greenc-FNAL March 11, 2026 19:55 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

greenc-FNAL force-pushed the jules-maintenance-fix-pr-comment-reactions-18132869807280577001 branch from 4b59517 to 6aca4df Compare March 12, 2026 03:04

greenc-FNAL requested a review from Copilot March 12, 2026 03:04

Copilot started reviewing on behalf of greenc-FNAL March 12, 2026 03:04 View session

greenc-FNAL changed the title ~~maintenance: Fix and consolidate PR comment reactions~~ maintenance: correct tidy-fix comment reactions, and aggressive consolidation Mar 12, 2026

Copilot AI reviewed Mar 12, 2026

View reviewed changes

github-actions bot and others added 2 commits March 12, 2026 09:22

Apply ruff fixes

da0713a

greenc-FNAL force-pushed the jules-maintenance-fix-pr-comment-reactions-18132869807280577001 branch from 6aca4df to 8fd1ce2 Compare March 12, 2026 14:23

github-advanced-security bot found potential problems Mar 12, 2026

View reviewed changes

greenc-FNAL requested a review from Copilot March 12, 2026 14:36

Copilot started reviewing on behalf of greenc-FNAL March 12, 2026 14:37 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 12, 2026

fix: artifact download nested path and missing issues: write permission #419

Merged

greenc-FNAL requested a review from Copilot March 12, 2026 19:25

Copilot started reviewing on behalf of greenc-FNAL March 12, 2026 19:25 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 12, 2026

fix: workflow permissions and relevance-check bypass regressions #420

Merged

greenc-FNAL requested a review from Copilot March 12, 2026 19:53

Copilot started reviewing on behalf of greenc-FNAL March 12, 2026 19:54 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 12, 2026

fix: wire workflow_call inputs, act fallback for change detection, and correct clang-tidy/format-all failure behavior #421

Merged

Apply YAML formatter fixes

333f6d3

greenc-FNAL requested a review from Copilot March 12, 2026 20:27

Copilot started reviewing on behalf of greenc-FNAL March 12, 2026 20:28 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Adding missing permissions for issue comments

749ae5b

Per #411 (comment)

greenc-FNAL force-pushed the jules-maintenance-fix-pr-comment-reactions-18132869807280577001 branch from f333886 to 749ae5b Compare March 12, 2026 23:38

@@ -43,7 +43,8 @@
                     fetch-depth: 0
                     path: ${{ inputs.checkout-path }}
                     ref: ${{ inputs.ref }}
-                    repository: ${{ inputs.repo }}
+                    # Always check out from the current repository to avoid untrusted external repos
+                    repository: ${{ github.repository }}
                 - name: Detect relevant changes
                   id: filter
@@ -65,4 +66,3 @@
                       echo "::group::Relevant files detected"
                       printf '%s\n' "${{ steps.filter.outputs.matched_files }}"
                       echo "::endgroup::"
-                    fi

Conversation

greenc-FNAL commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

google-labs-jules bot commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greenc-FNAL commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Format Fixes Applied

Uh oh!

greenc-FNAL commented Mar 12, 2026

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Check warning

Copilot Autofix

greenc-FNAL commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greenc-FNAL commented Mar 12, 2026

Uh oh!

Copilot AI commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greenc-FNAL commented Mar 12, 2026

Uh oh!

Copilot AI commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greenc-FNAL commented Mar 11, 2026 •

edited

Loading