feat: add version update check for compile-agentic activation#23575
Merged
feat: add version update check for compile-agentic activation#23575
Conversation
- Add config.json at repo root with blockedVersions and minimumVersion fields - Add config.schema.json JSON schema for config.json validation - Add check_version_updates.cjs JavaScript script that downloads config.json from raw.githubusercontent.com and validates the compiled version is not blocked and meets the minimum supported version requirement - Add check_version_updates.test.cjs test file with comprehensive coverage - Add update-check: false frontmatter flag to FrontmatterConfig and WorkflowData - Add validateUpdateCheck() that errors in strict mode, warns in non-strict - Add update-check field to main_workflow_schema.json - Add update check step to activation job for release builds - Add config.json validation step to ci.yml validate-yaml job - Add unit tests for validateUpdateCheck and activation job step generation Agent-Logs-Url: https://github.com/github/gh-aw/sessions/59710bfc-6f7b-4d62-ae00-03f2f989ad07 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Use case-insensitive normalization to ensure v1.0.0 and 1.0.0 are treated as the same version in blocked versions comparison. Update tests accordingly. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/59710bfc-6f7b-4d62-ae00-03f2f989ad07 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
March 30, 2026 18:34
View session
Collaborator
|
@copilot move config.json to |
Update all references (CONFIG_URL in JS script, CI validation step, path triggers) to use the new .github/aw/config.json location. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6a615d1f-4dc0-4f98-8b42-66a7f02930b3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
pelikhan
reviewed
Mar 30, 2026
.github/workflows/ci.yml
Outdated
|
|
||
| echo "✅ All URLs in $AGENT_FILE correctly use 'main' branch" | ||
|
|
||
| - name: Validate config.json against JSON schema |
Collaborator
There was a problem hiding this comment.
@copilot use actions/github-script, not Python.
Contributor
Author
There was a problem hiding this comment.
Done in dbd3916 — replaced the Python step with actions/github-script. The validation logic is now inline JavaScript that reads and validates .github/aw/config.json using fs and core.
| * Fails the activation job when validation fails. | ||
| */ | ||
|
|
||
| const https = require("https"); |
Collaborator
There was a problem hiding this comment.
@copilot use nodejs fetch function. Actions/github-script uses node 24
Contributor
Author
There was a problem hiding this comment.
Done in dbd3916 — removed the https module and fetchText wrapper; main() now uses fetch directly (built-in since Node 18, available in the Node 24 environment used by actions/github-script).
- Replace https module with native fetch in check_version_updates.cjs
(actions/github-script runs Node 24 which has fetch built-in)
- Update test mocks to use vi.stubGlobal('fetch') instead of https mock
- Replace Python CI validation step with actions/github-script step
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8d9befd2-5563-48e8-9b7c-445eb4563973
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Collaborator
|
@copilot the minimum version should be the current release v0.64.4 |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3c01f087-68bb-4f04-b1b5-1fbcb761eb06 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Collaborator
|
@copilot use withRetry to handle intermittent failures of |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2aade6d8-94e4-4b94-9448-af6bbf7eff30 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in e45dd40 — the |
pelikhan
reviewed
Mar 30, 2026
.github/workflows/ci.yml
Outdated
| - '.github/workflows/ci.yml' | ||
| - '.github/workflows/**/*.md' | ||
| - '.github/aw/config.json' | ||
| - 'config.schema.json' |
Contributor
Author
There was a problem hiding this comment.
Done in 9849ac9 — moved config.schema.json to .github/aw/config.schema.json, updated the $schema reference in config.json, the path trigger in ci.yml, and the schema file path in the validation step.
|
|
||
| const CONFIG_URL = "https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/config.json"; | ||
|
|
||
| /** |
Collaborator
There was a problem hiding this comment.
@copilot do not handle both format, if the version is not vmajor.minor.patch, it should NOT be treated as an official release and ignore.
Contributor
Author
There was a problem hiding this comment.
Done in 9849ac9 — removed normalizeVersion. parseVersion now requires a leading v; any version without it returns null. In main(), after the dev-build skip, the compiled version is parsed and if it's not vMAJOR.MINOR.PATCH the check is skipped entirely ("not an official release version"). Blocked version config entries without a v prefix are also silently ignored.
| async function main() { | ||
| const compiledVersion = process.env.GH_AW_COMPILED_VERSION || ""; | ||
|
|
||
| if (!compiledVersion || compiledVersion === "dev") { |
Collaborator
There was a problem hiding this comment.
@copilot ignore unknown versions, or unknown syntax
Contributor
Author
There was a problem hiding this comment.
Done in 9849ac9 — unknown/non-parseable versions are now ignored at every point: compiled version with unknown syntax skips the check early; blocked version entries with unknown syntax are filtered out; a minimumVersion with unknown syntax is treated as absent and the minimum check is skipped.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a runtime “compiled version support” gate to the activation job so workflows compiled with blocked/outdated gh-aw releases fail fast (with an opt-out in non-strict mode).
Changes:
- Introduces remote update-check configuration (
.github/aw/config.json) with a JSON schema and CI validation. - Adds an activation-job GitHub Script step that fetches the remote config and enforces blocked/minimum supported versions for release builds.
- Adds
update-checkfrontmatter support, compiler plumbing, and strict/non-strict validation behavior (+ tests).
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
pkg/workflow/update_check_validation.go |
Implements strict/non-strict policy for update-check: false. |
pkg/workflow/update_check_validation_test.go |
Tests strict/non-strict validation and activation job step inclusion/exclusion. |
pkg/workflow/frontmatter_types.go |
Adds typed UpdateCheck *bool frontmatter field. |
pkg/workflow/compiler_types.go |
Adds UpdateCheckDisabled flag to WorkflowData. |
pkg/workflow/compiler_orchestrator_workflow.go |
Plumbs update-check into WorkflowData.UpdateCheckDisabled. |
pkg/workflow/compiler_orchestrator_engine.go |
Enforces update-check policy during compilation. |
pkg/workflow/compiler_activation_job.go |
Adds the activation-job step to check compiled version (release builds only). |
pkg/parser/schemas/main_workflow_schema.json |
Documents/adds update-check boolean to the frontmatter schema. |
actions/setup/js/check_version_updates.cjs |
Implements remote config fetch + blocked/minimum version enforcement. |
actions/setup/js/check_version_updates.test.cjs |
Adds a comprehensive Vitest suite for the update-check script. |
.github/workflows/ci.yml |
Adds CI validation for .github/aw/config.json and path triggers. |
.github/aw/config.schema.json |
Defines JSON schema for the remote update-check config. |
.github/aw/config.json |
Sets initial minimumVersion and blocked list (empty). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+31
to
+37
| function parseVersion(version) { | ||
| if (!version.startsWith("v")) return null; | ||
| const parts = version.slice(1).split("."); | ||
| if (parts.length < 3) return null; | ||
| const nums = parts.slice(0, 3).map(Number); | ||
| if (nums.some(isNaN)) return null; | ||
| return nums; |
There was a problem hiding this comment.
parseVersion() claims to enforce strict vMAJOR.MINOR.PATCH but currently accepts versions with extra dot segments (e.g. v1.2.3.4 parses as [1,2,3]). This can incorrectly treat non-release/invalid versions as official releases and run comparisons against truncated versions. Require exactly 3 numeric parts (or use a strict regex) and add a unit test for an extra-segment version to prevent regressions.
Comment on lines
+88
to
+93
| config = await withRetry( | ||
| async () => { | ||
| const res = await fetch(CONFIG_URL); | ||
| if (!res.ok) { | ||
| throw new Error(`HTTP ${res.status} fetching ${CONFIG_URL}`); | ||
| } |
There was a problem hiding this comment.
The retry behavior for HTTP responses does not match the PR description (“5xx responses are retried”). Here, a non-OK response throws Error("HTTP <status> fetching ..."), but isTransientError() only matches specific strings like "502 bad gateway"/"503 service unavailable" and will treat HTTP 500 ... as non-retryable (so no retries happen). Consider making the fetch retry predicate explicitly retry on res.status >= 500 (e.g., by throwing an error that carries status, or by checking status before throwing) and add a test asserting a 500 triggers retries.
Comment on lines
+94
to
+107
| return JSON.parse(await res.text()); | ||
| }, | ||
| { shouldRetry: isTransientError }, | ||
| "fetch update configuration" | ||
| ); | ||
| } catch (err) { | ||
| const message = err instanceof Error ? err.message : String(err); | ||
| core.info(`Could not fetch update configuration (${message}). Skipping version check.`); | ||
| return; | ||
| } | ||
|
|
||
| const blockedVersions = Array.isArray(config.blockedVersions) ? config.blockedVersions : []; | ||
| const minimumVersion = typeof config.minimumVersion === "string" ? config.minimumVersion : ""; | ||
|
|
There was a problem hiding this comment.
JSON.parse(await res.text()) can legally return null. If the remote config ever becomes null (valid JSON) this will later throw a TypeError when reading config.blockedVersions / config.minimumVersion. Guard by normalizing non-object/null values to {} before accessing properties, and add a unit test for a null config payload.
.github/workflows/ci.yml
Outdated
Comment on lines
+841
to
+848
| - name: Validate config.json against JSON schema | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| with: | ||
| script: | | ||
| const fs = require('fs'); | ||
| const CONFIG_FILE = '.github/aw/config.json'; | ||
| const SCHEMA_FILE = '.github/aw/config.schema.json'; | ||
|
|
There was a problem hiding this comment.
This step is labeled as validating config.json “against JSON schema”, but the script never loads or applies the schema file—it performs a separate, hand-maintained validation (allowedKeys/regexes) that can drift from .github/aw/config.schema.json. Either use an actual JSON Schema validator (e.g., Ajv) with config.schema.json, or rename the step to reflect that it’s a manual validation and keep the schema/validation logic single-sourced.
pelikhan
reviewed
Mar 30, 2026
| "description": "Mark the workflow as private, preventing it from being added to other repositories via 'gh aw add'. A workflow with private: true is not meant to be shared outside its repository.", | ||
| "examples": [true, false] | ||
| }, | ||
| "update-check": { |
Contributor
Author
There was a problem hiding this comment.
Done in 3df3708 — renamed update-check to check-for-updates across the schema, struct tag, frontmatter lookup, validation logic, error/warning messages, comments, and tests.
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/aee8b4ff-b368-488a-936c-575be961994d Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
pelikhan
reviewed
Mar 30, 2026
| @@ -0,0 +1,5 @@ | |||
| { | |||
Collaborator
There was a problem hiding this comment.
@copilot rename this file to "releases.json" and rename json schema accordingly. Update all references.
Contributor
Author
There was a problem hiding this comment.
Done in 04475fd — renamed config.json → releases.json and config.schema.json → releases.schema.json. Updated the $schema reference inside releases.json, the raw.githubusercontent.com URL in check_version_updates.cjs, the path triggers and validation step in ci.yml, and the comment in compiler_activation_job.go.
…eleases.schema.json Agent-Logs-Url: https://github.com/github/gh-aw/sessions/41c86414-a1da-45fc-b4a5-e7a02c2afdd4 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot add a "minRecommendedVersion" that adds a soft check to nudge the user to do a recommended upgrade. This nudge leads to a "warning" in the Actions run (core.warning). Current minRecommendedVersion is minVersion. |
Collaborator
|
@copilot review comments |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0a47dfd8-c235-472e-8cd2-03dea5c8ac28 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 4c4d242 — added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/98a52178-3364-4197-a184-a4e0f3a85656 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 9363d66 — addressed all four review comments:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a runtime version update check to the activation job that validates whether the compiled workflow's
gh-awversion is still supported, before allowing the agentic job to run.How it works
.github/aw/releases.json– A new file in the protected.github/aw/directory defines blocked versions, a minimum supported version, and a minimum recommended version. The.github/aw/releases.schema.jsonschema validates its structure. BothminimumVersionandminRecommendedVersionare set tov0.64.4(current release).check_version_updates.cjs– A JavaScript script added to the activation job that:.github/aw/releases.jsonfromhttps://raw.githubusercontent.com/github/gh-aw/main/.github/aw/releases.jsonviaraw.githubusercontent.comfetchAPI (available in Node 24, the runtime used byactions/github-script)fetchcall withwithRetry/isTransientErrorfromerror_recovery.cjsto handle intermittent network failures (transient errors such as ECONNRESET, timeouts, and 5xx responses are retried up to 3 times with exponential backoff)vMAJOR.MINOR.PATCHformat are treated as official releases; any other format (missingvprefix, non-numeric parts, etc.) is ignored and the check is skippedblockedVersions(e.g. revoked security-compromised versions); blocked list entries with unknown/invalid format are silently ignoredminimumVersion(hard failure); ifminimumVersionhas unknown/invalid format it is treated as absent and the check is skippedminRecommendedVersion(soft nudge viacore.warning); ifminRecommendedVersionhas unknown/invalid format it is treated as absent and the check is skippedcheck-for-updates: falsefrontmatter flag – Disables the update check step:Activation job step – Added for release builds only (dev builds skip it). The step runs after the timestamp check.
CI validation – A new step in the
validate-yamljob validates.github/aw/releases.jsonagainst.github/aw/releases.schema.jsonusingactions/github-script(inline JavaScript). Version patterns in both the schema and CI validation require thevprefix.Files changed
.github/aw/releases.json– New update check configuration file withminimumVersion: v0.64.4andminRecommendedVersion: v0.64.4, placed in the protected.github/aw/directory.github/aw/releases.schema.json– JSON schema forreleases.json; includesminimumVersionandminRecommendedVersionproperties; version patterns require strictvMAJOR.MINOR.PATCHformatactions/setup/js/check_version_updates.cjs– Version check script (nativefetchwrapped inwithRetry/isTransientError; strictvMAJOR.MINOR.PATCHenforcement; unknown version formats ignored;core.warningnudge forminRecommendedVersion)actions/setup/js/check_version_updates.test.cjs– Extensive test suite (46 tests) covering: skip cases, network failures, retry success, soft-fail for invalid JSON, version comparison edge cases, blocked/minimum version scenarios,minRecommendedVersionsoft-warning scenarios, and config structure edge casespkg/workflow/frontmatter_types.go– AddedUpdateCheck *boolfield with JSON tagcheck-for-updatespkg/parser/schemas/main_workflow_schema.json– Addedcheck-for-updatespropertypkg/workflow/compiler_types.go– AddedUpdateCheckDisabled booltoWorkflowDatapkg/workflow/compiler_orchestrator_workflow.go– Extractscheck-for-updatesflagpkg/workflow/update_check_validation.go– NewvalidateUpdateCheckfunctionpkg/workflow/update_check_validation_test.go– Unit testspkg/workflow/compiler_orchestrator_engine.go– CallsvalidateUpdateCheckpkg/workflow/compiler_activation_job.go– Adds update check step for release builds.github/workflows/ci.yml– Adds.github/aw/releases.jsonschema validation step (viaactions/github-script) + path triggers for.github/aw/releases.schema.json; validatesminRecommendedVersionfield