Merge remote-tracking branch 'origin/abhitejjohn-issue-pr-triage-37b' into abhitejjohn-issue-pr-triage-37b

# Conflicts: # .github/aw/shared/devops-health.lock.md # .github/workflows/devops-health-check.lock.yml # .github/workflows/devops-health-check.md # .github/workflows/devops-health-groom.lock.yml # .github/workflows/devops-health-groom.md # .github/workflows/devops-health-investigate.lock.yml # eng/evaluation/test_token_failover.py
2026-09-20 09:49:54 +08:00 · 2026-09-16 16:17:22 +02:00
parent 8da2d259da 1219cb0e2e
commit 9196fe0324
3 changed files with 44 additions and 19 deletions
@@ -154,23 +154,38 @@ When `finding_type == "resource"`:
 All investigation results follow this template:

 ```markdown
-🔍 **Investigation Complete** — [Worker Run #{run_number}]({run_url})
+## 🔍 Investigation: {canonical_title derived from trusted metadata}

-**Root cause:** {Clear, evidence-based description of what went wrong and why.
-Include specific error messages, commit SHAs, or file paths as evidence.}
+**Finding ID:** `{finding_id}`
+**Severity:** {finding_severity}
+**Correlation:** {correlation_id}
+**Executive Summary:** {one-sentence summary of the root cause and recommended action}

-**Confidence:** {High|Medium|Low} — {One sentence justifying the confidence level}
+### Root Cause
+{one-paragraph description with evidence}

-**Blast radius:** {What else is affected by this issue. Be specific about which
-components, workflows, or metrics are impacted.}
+**Confidence:** {High|Medium|Low} — {justification}

-**Suggested fix:**
-1. {Most recommended action — include specific file, line, or command}
-2. {Alternative action if applicable}
-3. {Additional step if needed}
+### Blast Radius
+{what else is affected}

-**Related:** {List related commits (with SHA + author), PRs (with #number), or
-issues (with #number). Say "None found" if nothing is related.}
+### Suggested Fix
+1. {step 1}
+2. {step 2}
+3. {step 3, if applicable}
+
+### Remediation Status
+Report-only. {Trusted evidence, proposed change, validation plan, and owner,
+or why the available evidence cannot verify an exact fix.}
+
+### Evidence
+{key log excerpts, API responses, or code references}
+
+### Related
+{commits, PRs, issues, or "None found"}
+
+---
+<sub>🔍 [Investigation Run #{run_number}]({run_url}) · Dispatched by health check · {correlation_id}</sub>
 ```

 ### Confidence Level Guidelines
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"dbab90ee2fde5b854815645a41621830dbe3412d2ffa778eabd8d2f2b2b5e7aa","body_hash":"f29b540d1b8b133318b795b7d6c28aeadbcda257d313bdcbeb5f05622d772afd","compiler_version":"v0.88.7","strict":true,"agent_id":"copilot","agent_model":"${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'gpt-5.6-sol' }}","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"f9595fa76cc610870429131c2e44d146538259915b995c8abb61e6a5d7448c93","body_hash":"ac4a71683c6416021b4177b2b61692e622600cf58a91762e5dda5d0b1c1daca7","compiler_version":"v0.88.7","strict":true,"agent_id":"copilot","agent_model":"${{ vars.GH_AW_MODEL_AGENT_COPILOT || vars.GH_AW_DEFAULT_MODEL_COPILOT || 'gpt-5.6-sol' }}","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_PAT_0","COPILOT_PAT_1","COPILOT_PAT_2","COPILOT_PAT_3","COPILOT_PAT_4","COPILOT_PAT_5","COPILOT_PAT_6","COPILOT_PAT_7","COPILOT_PAT_8","COPILOT_PAT_9","GH_AW_DEFAULT_OTLP_HEADERS","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"5e508589e03a7757a7e05b26e834292f5445bfb6","version":"v0.88.7"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.14","digest":"sha256:f7df036c86575527b61f3f7df91c4412349a12b2a74988d929eafa2999230c98","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.14@sha256:f7df036c86575527b61f3f7df91c4412349a12b2a74988d929eafa2999230c98"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14","digest":"sha256:6f95e2234dd9bd6333a8ff28ccea7ecf0204acd4a09108723844dbd2bf6268c5","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.14@sha256:6f95e2234dd9bd6333a8ff28ccea7ecf0204acd4a09108723844dbd2bf6268c5"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.14","digest":"sha256:2ce8df3abf3e9b76e9c0cf5863da41f1ab3f89b20ad14b988806ab89e7bf2cd5","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.14@sha256:2ce8df3abf3e9b76e9c0cf5863da41f1ab3f89b20ad14b988806ab89e7bf2cd5"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.18","digest":"sha256:85b940556a8faa4e1fdbef124bfd75f2c4ebd855a10b88a1c3b6f3e97f6f1a53","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.18@sha256:85b940556a8faa4e1fdbef124bfd75f2c4ebd855a10b88a1c3b6f3e97f6f1a53"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:33e1ec1d967ac1f28c2cedc24ce103dea3226840626de345d3fe579e96cf5c7d","pinned_image":"ghcr.io/github/gh-aw-node@sha256:33e1ec1d967ac1f28c2cedc24ce103dea3226840626de345d3fe579e96cf5c7d"},{"image":"ghcr.io/github/github-mcp-server:v1.11.0","digest":"sha256:fbec75de11c255213fa08d80fb166abe73d851fff631c51c0079872967720699","pinned_image":"ghcr.io/github/github-mcp-server:v1.11.0@sha256:fbec75de11c255213fa08d80fb166abe73d851fff631c51c0079872967720699"}],"mcp_servers":[{"name":"github","tools":["actions_get","actions_list","get_commit","get_file_contents","get_job_logs","get_latest_release","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["add_comment","missing_data","missing_tool","noop"]}]}
 # This file was automatically generated by gh-aw (v0.88.7). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -69,6 +69,8 @@
 name: "DevOps Health — Deep Investigation"
 on:
  # permissions: {} # Permissions applied to pre-activation job
+  # roles: all # Roles processed as role check in pre-activation job
+  # skip-if-no-match: is:issue is:open label:devops-health # Skip-if-no-match processed as search check in pre-activation job
  workflow_dispatch:
    inputs:
      aw_context:
@@ -455,6 +457,9 @@ jobs:
      contents: read
      issues: read
      pull-requests: read
+    concurrency:
+      group: "gh-aw-copilot-${{ github.workflow }}-${{ github.run_id }}"
+      queue: max
    timeout-minutes: 60
    env:
      DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
@@ -1792,7 +1797,7 @@ jobs:
    env:
      GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
    outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
+      activated: ${{ steps.check_skip_if_no_match.outputs.skip_no_match_check_ok == 'true' }}
      matched_command: ''
      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
      setup-span-id: ${{ steps.setup.outputs.span-id }}
@@ -1810,19 +1815,20 @@ jobs:
          GH_AW_INFO_VERSION: "1.0.80"
          GH_AW_INFO_AWF_VERSION: "v0.28.14"
          GH_AW_INFO_ENGINE_ID: "copilot"
-      - name: Check team membership for workflow
-        id: check_membership
+      - name: Check skip-if-no-match query
+        id: check_skip_if_no_match
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
-          GH_AW_REQUIRED_ROLES: "admin,maintainer,write"
+          GH_AW_SKIP_QUERY: "is:issue is:open label:devops-health"
+          GH_AW_WORKFLOW_NAME: "DevOps Health — Deep Investigation"
+          GH_AW_SKIP_MIN_MATCHES: "1"
        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require(path.join(actionsDir, 'check_membership.cjs'));
+            const { main } = require(path.join(actionsDir, 'check_skip_if_no_match.cjs'));
            await main();

  safe_outputs:
@@ -38,6 +38,8 @@ on:
        required: false
        type: boolean
        default: false
+  roles: all
+  skip-if-no-match: "is:issue is:open label:devops-health"

 concurrency:
  group: gh-aw-${{ github.workflow }}-${{ inputs.finding_id }}
@@ -137,6 +139,8 @@ any resource, enforce all of these rules:
   pull request, issue, blob, tree, or repository-root URL that is relevant to
   the finding fingerprint. Do not fetch a resource merely because an input
   points to it.
+7. `correlation_id` matches
+   `hc-{YYYY-MM-DD}-{numeric_health_run_id}-{numeric_sequence}`.

 After the structural checks, fetch only the trusted GitHub metadata or
 repository configuration needed to recompute the finding. Do not fetch