feat: add release highlights generator agentic workflow #197

Copilot · 2026-01-10T04:52:44Z

Dry Run Mode

The workflow now supports a dry_run input option when triggered manually via workflow_dispatch. In dry run mode:

Docker images are built but NOT pushed to the registry
Signing and SBOM attestation steps are skipped
Release notes are previewed in the logs but no release is created
AI agent step is skipped (no release to update)
All artifacts are still uploaded for inspection

This allows testing the full build pipeline without making any external changes.

Custom agent used: create-agentic-workflow
Design agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.

Original prompt

convert release pipeline into an agentic workflow. Keep the release process, but add a Release Highlights Generator agent to Generate an engaging release highlights summary for this repo and this release tag.

Custom agent used: create-agentic-workflow
Design agentic workflows using GitHub Agentic Workflows (gh-aw) extension with interactive guidance on triggers, tools, and security best practices.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Mossaka

@copilot

Mossaka · 2026-01-10T16:59:26Z

.github/workflows/release-highlights.md

+description: Generate an engaging release highlights summary for new releases
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+tools:
+  github:
+    toolsets: [default]
+  bash:
+    - "git log:*"
+    - "git diff:*"
+    - "git tag:*"
+    - "git show:*"
+safe-outputs:
+  update-release:
+    max: 1
+timeout-minutes: 10


This release highlights generator should be combined with the current release pipeline. Check out https://github.com/githubnext/gh-aw/blob/main/.github/workflows/release.md for inspiration

Combined the release highlights generator with the release pipeline in commit 81002e8. The release.md now includes:

jobs: with the full build/release process

steps: to prepare release data for the agent

Prompt section for AI-generated highlights

update-release safe output to prepend highlights

The pattern now matches the gh-aw reference workflow.

@copilot looks good to me can you add a dry run option to this workflow so that I can test it out?

Added dry_run option in commit ac7eb3f. You can now test the workflow via manual dispatch with "Dry run mode" enabled. In dry run mode:

Docker images are built but NOT pushed

Signing/SBOM steps are skipped

Release notes are previewed in the logs but no release is created

AI agent step is skipped (no release to update)

All artifacts are still uploaded for inspection.

github-actions · 2026-01-13T07:49:03Z

Test Coverage Report

Metric	Coverage	Covered/Total
Lines	77.19%	1300/1684
Statements	77.27%	1333/1725
Functions	77.17%	142/184
Branches	69.76%	450/645

Coverage Thresholds

The project has the following coverage thresholds configured:

Lines: 38%
Statements: 38%
Functions: 35%
Branches: 30%

Coverage report generated by `npm run test:coverage`

github-actions · 2026-01-15T23:38:05Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2026-01-15T23:38:09Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-01-15T23:40:55Z

Smoke Test Results

Last 2 merged PRs:

docs: remove docker-in-docker references #220: docs: remove docker-in-docker references
fix: critical firewall bypass via non-standard ports (CVSS 8.2) #213: fix: critical firewall bypass via non-standard ports (CVSS 8.2)

Test Results:

✅ GitHub MCP Testing
✅ File Writing Testing
✅ Bash Tool Testing

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #197 🗺️

github-actions · 2026-01-15T23:42:22Z

Smoke Test Results (Claude Engine)

Last 2 merged PRs:

docs: remove docker-in-docker references #220: docs: remove docker-in-docker references
feat: remove Docker-in-Docker support #205: feat: remove Docker-in-Docker support

Test Results:

✅ GitHub MCP: Read PR list
✅ File Write: Created /tmp/gh-aw/agent/smoke-test-claude-21050172371.txt
✅ Bash Tool: Verified file content
❌ Playwright MCP: Connection errors (ERR_TUNNEL_CONNECTION_FAILED)

Overall Status: FAIL (Playwright connectivity issues)

💥 [THE END] — Illustrated by Smoke Claude fer issue #197 🗺️

GitHub's default CodeQL setup was attempting to analyze Python code, but this repository only contains JavaScript/TypeScript and GitHub Actions. The false detection was caused by a Python file in node_modules (flatted/python/flatted.py). This explicit workflow: - Only analyzes javascript-typescript and actions languages - Replaces the default setup with controlled configuration - Prevents "no source code found" errors for Python - Runs on PR, push to main, weekly schedule, and manual dispatch Fixes the CodeQL failure in PR #197. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

github-actions · 2026-01-15T23:52:06Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2026-01-15T23:52:08Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-01-15T23:54:50Z

Smoke Test Results

GitHub MCP: ✅ #225, #224
File Writing: ✅ Created test file
Bash Tool: ✅ Verified file

Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #197 🗺️

github-actions · 2026-01-15T23:56:03Z

Smoke Test Results (Claude Engine)

Last 2 merged PRs:

chore: remove security fix status file #215: chore: remove security fix status file
docs: add threat model for post-PR #205 simplified architecture #225: docs: add threat model for post-PR feat: remove Docker-in-Docker support #205 simplified architecture

Test Results:

✅ GitHub MCP: Retrieved PRs successfully
✅ File Writing: Created test file with timestamp
✅ Bash Tool: Verified file creation
❌ Playwright MCP: Page loaded but assets failed (ERR_TUNNEL_CONNECTION_FAILED)

Overall Status: FAIL (Playwright connectivity issue)

💥 [THE END] — Illustrated by Smoke Claude fer issue #197 🗺️

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Adds a validation step that checks package.json version matches the git tag version before building. This prevents the issue where a tag is created on a commit with the wrong version number, which caused the v0.9.0 release to initially fail smoke tests. The validation step provides clear error messages and remediation steps when a mismatch is detected. Resolves the root cause of workflow run 21004691307 failure.

GitHub's default CodeQL setup was attempting to analyze Python code, but this repository only contains JavaScript/TypeScript and GitHub Actions. The false detection was caused by a Python file in node_modules (flatted/python/flatted.py). This explicit workflow: - Only analyzes javascript-typescript and actions languages - Replaces the default setup with controlled configuration - Prevents "no source code found" errors for Python - Runs on PR, push to main, weekly schedule, and manual dispatch Fixes the CodeQL failure in PR #197. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

github-actions · 2026-01-16T00:04:05Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-01-16T00:04:08Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

github-actions · 2026-01-16T00:06:57Z

Smoke Test Results

Last 2 Merged PRs:

fix(deps): resolve docs npm audit #226: fix(deps): resolve docs npm audit
ci: add docs-only path filters #224: ci: add docs-only path filters

Test Results:

✅ GitHub MCP - Retrieved PR data
✅ File Writing - Created test file successfully
✅ Bash Tool - Verified file contents

Overall Status: PASS

📰 BREAKING: Report filed by Smoke Copilot fer issue #197 🗺️

PR #706 hid /tmp/gh-aw/mcp-logs/ from agent containers using tmpfs mounts but missed /tmp/gh-aw/mcp-config/, which may contain MCP server configuration with tokens and credentials (CVE-003 from issue #197). Apply the same tmpfs hiding pattern for mcp-config in both normal and chroot modes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mossaka · 2026-02-12T05:25:03Z

Pentest Findings Follow-Up

PR #716 addresses the remaining gap from this pentest report. Here's the status of all findings:

Finding	Status	Details
CVE-001: API key via `/proc/1/environ`	✅ Mitigated	One-shot-token LD_PRELOAD library prevents reading environment variables from `/proc/*/environ`
CVE-002: HTTP/HTTPS exfiltration	✅ Mitigated	Squid proxy domain filtering (AWF's core feature) blocks unauthorized egress
CVE-003: MCP config directory exposed	✅ Fixed in #716	`/tmp/gh-aw/mcp-config/` is now hidden from agent containers using tmpfs overlay (same pattern as mcp-logs hiding from #706)
CVE-004: DNS tunneling	⚠️ Partially mitigated	`--dns-servers` flag restricts DNS to trusted resolvers, limiting but not fully preventing DNS-based exfiltration

CVE-004 Note

DNS tunneling remains a known limitation. The --dns-servers restriction ensures DNS queries only go to configured resolvers (default: Google DNS), which prevents using arbitrary DNS servers for data exfiltration. However, sophisticated DNS tunneling via allowed resolvers is still theoretically possible. Full mitigation would require DNS payload inspection, which is out of scope for the current architecture.

Copilot AI assigned Copilot and Mossaka Jan 10, 2026

Copilot started work on behalf of Mossaka January 10, 2026 04:53 View session

Copilot AI changed the title ~~[WIP] Convert release pipeline into an agentic workflow~~ feat: add release highlights generator agentic workflow Jan 10, 2026

Copilot AI requested a review from Mossaka January 10, 2026 04:58

Copilot finished work on behalf of Mossaka January 10, 2026 04:58

Mossaka reviewed Jan 10, 2026

View reviewed changes

Copilot started work on behalf of Mossaka January 10, 2026 17:03 View session

Copilot AI requested a review from Mossaka January 10, 2026 17:09

Copilot finished work on behalf of Mossaka January 10, 2026 17:09

Copilot started work on behalf of Mossaka January 10, 2026 17:46 View session

Copilot finished work on behalf of Mossaka January 10, 2026 17:50

Mossaka marked this pull request as ready for review January 13, 2026 07:48

github-actions bot added the smoke-copilot label Jan 15, 2026

Copilot AI and others added 6 commits January 16, 2026 00:03

Initial plan

a51dcd3

feat: add release highlights generator agentic workflow

6407de6

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

refactor: combine release highlights generator with release pipeline

d106ef5

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

feat: add dry run option to release workflow

e890620

Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>

Mossaka force-pushed the copilot/add-release-highlights-generator branch from 9dd0757 to 5ac3a47 Compare January 16, 2026 00:03

Mossaka merged commit 33acf81 into main Jan 16, 2026
46 of 50 checks passed

Mossaka deleted the copilot/add-release-highlights-generator branch January 16, 2026 00:53

Mossaka mentioned this pull request Feb 12, 2026

fix: hide /tmp/gh-aw/mcp-config/ from agent containers #716

Closed

4 tasks

feat: add release highlights generator agentic workflow #197

feat: add release highlights generator agentic workflow #197

Uh oh!

Conversation

Copilot AI commented Jan 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dry Run Mode

Uh oh!

Mossaka left a comment

Choose a reason for hiding this comment

Uh oh!

Mossaka Jan 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 10, 2026

Choose a reason for hiding this comment

Uh oh!

Mossaka Jan 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 10, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Coverage Report

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 15, 2026

Smoke Test Results (Claude Engine)

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

github-actions bot commented Jan 15, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Jan 15, 2026

Smoke Test Results (Claude Engine)

Uh oh!

github-actions bot commented Jan 16, 2026

Uh oh!

github-actions bot commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 16, 2026

Smoke Test Results

Uh oh!

Uh oh!

Mossaka commented Feb 12, 2026

Pentest Findings Follow-Up

CVE-004 Note

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 10, 2026 •

edited

Loading

github-actions bot commented Jan 13, 2026 •

edited

Loading

github-actions bot commented Jan 16, 2026 •

edited

Loading