GitHub Agentic Workflows
This report presents the forensic synthetic code analysis of github/gh-aw, a Go project with 4,759 GitHub stars. SynthScan v2.0 examined 1,594,812 lines of code across 5134 source files, recording 4813 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 4.3 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4813 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install-gh-aw.sh | 1 | #!/bin/bash | COMMENT |
| LOW | cmd/linters/main.go | 1 | // Command linters runs the gh-aw custom analysis linters. | COMMENT |
| LOW | .serena/project.yml | 1 | # list of languages for which language servers are started; choose from: | COMMENT |
| LOW | .serena/project.yml | 21 | # the encoding used by text files in the project | COMMENT |
| LOW | .serena/project.yml | 41 | # Below is the complete list of tools for convenience. | COMMENT |
| LOW | .serena/project.yml | 61 | # * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol. | COMMENT |
| LOW | .serena/project.yml | 81 | # initial prompt for the project. It will always be given to the LLM upon activating the project | COMMENT |
| LOW | .serena/project.yml | 101 | # Otherwise, this overrides the setting from the global configuration (serena_config.yml). | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 61 | # List functions with line numbers | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 101 | // # {Domain} Validation | COMMENT |
| LOW | scratchpad/repo-memory.md | 221 | COMMENT | |
| LOW | scratchpad/repo-memory.md | 241 | # } | COMMENT |
| LOW | scratchpad/gastown.md | 321 | # Human: Create work campaign | COMMENT |
| LOW | docs/public/editor/hover-tooltips.js | 1 | // ================================================================ | COMMENT |
| LOW | docs/src/content.config.ts | 41 | // owner: 'githubnext', // GitHub org/user | COMMENT |
| LOW | …src/content/docs/specs/fuzzy-schedule-specification.md | 1141 | ## Appendices | COMMENT |
| LOW | …src/content/docs/specs/fuzzy-schedule-specification.md | 1161 | # Might generate: 37 12 * * * (12:37 PM, within 9 AM-5 PM) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 21 | # Workflow name that appears in the GitHub Actions interface. If not specified, | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 41 | # Optional workflow location redirect for updates. Format: workflow spec or GitHub | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 61 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 81 | # directory; (2) paths starting with '.github/' or '/' are resolved from the | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 101 | aw: [] | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 121 | # standard GitHub Actions trigger events plus special command triggers for | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 141 | # (without .md extension) as the command name | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 161 | name: "My Workflow" | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 181 | # least one). Use GitHub Actions event names. | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 201 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 221 | # Format 2: Array of command names that trigger this workflow (e.g., ['cmd.add', | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 241 | # Array items: GitHub Actions event name. | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 261 | # (optional) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 281 | # Array items: A label name | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 301 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 321 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 341 | tags-ignore: [] | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 361 | # Branches to ignore | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 381 | # When true, allows workflow to run on pull requests from forked repositories. | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 401 | names: "example-value" | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 421 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 441 | # Array of strings | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 461 | # Types of discussion comment events | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 481 | # Format 2: Array of schedule objects with cron expressions (standard cron or | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 501 | # (optional) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 521 | # Array of strings | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 541 | # (optional) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 561 | # (optional) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 601 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 641 | # Label event trigger that runs when a label is created, edited, or deleted | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 661 | milestone: | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 681 | # Accepted formats: | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 701 | branches: [] | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 721 | draft: true | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 741 | # (optional) | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 761 | # Status event trigger that runs when the status of a Git commit changes | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 801 | # dates (YYYY-MM-DD HH:MM:SS, June 1 2025, 1st June 2025, 06/01/2025, etc.) or | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 821 | # Format 2: Skip-if-match configuration object with query, maximum match count, | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 841 | # Scope for the search query. Set to 'none' to disable the automatic | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 861 | # or on.github-app fields. | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 881 | # Accepted formats: | COMMENT |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 901 | COMMENT | |
| LOW | docs/src/content/docs/reference/frontmatter-full.md | 921 | # levels. | COMMENT |
| 2395 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 132 | #### Document the two-file agentic workflow structure (separate `.github/agentics/<id>.md` prompt file and `.github/work | COMMENT |
| MEDIUM | CHANGELOG.md | 197 | #### Removed the stray `workdir` field from generated MCP server configurations for agentic workflows so the output matc | COMMENT |
| MEDIUM | CHANGELOG.md | 236 | #### Document the new two-file agentic workflow structure (separating `.github/agentics/` prompts from `.github/workflow | COMMENT |
| MEDIUM | CHANGELOG.md | 248 | #### Updated the embedded agentic tooling stack: | COMMENT |
| MEDIUM | CHANGELOG.md | 732 | #### Add importable tools: `agentic-workflows`, `serena`, and `playwright`. | COMMENT |
| MEDIUM | CHANGELOG.md | 1616 | #### Added new shared agentic workflow: Another one | COMMENT |
| MEDIUM | CHANGELOG.md | 2102 | #### Improve create-agentic-workflow prompt with writing style guidelines and user engagement tips | COMMENT |
| MEDIUM | CHANGELOG.md | 2147 | #### Add firewall agentic workflow demonstrating network permission enforcement | COMMENT |
| MEDIUM | CHANGELOG.md | 2188 | #### Fixed silent failure when agentic workflow hits max-turns limit - now raises clear error message | COMMENT |
| MEDIUM | CHANGELOG.md | 2271 | #### Add commit-changes-analyzer agentic workflow | COMMENT |
| MEDIUM | CHANGELOG.md | 2273 | #### Add agentic workflow for enhancing Go files with debug logging | COMMENT |
| MEDIUM | CHANGELOG.md | 2471 | #### Add generic timeout field for tools configuration. Allows configuring operation timeouts (in seconds) for tool/MCP | COMMENT |
| MEDIUM | CHANGELOG.md | 2501 | #### Update add command to resolve agentic workflow file from .github/workflows folder | COMMENT |
| MEDIUM | CHANGELOG.md | 2525 | #### Add builtin "agentic-workflows" tool for workflow introspection and analysis | COMMENT |
| MEDIUM | CHANGELOG.md | 2546 | #### Add secret validation steps to agentic engines (Claude, Copilot, Codex) | COMMENT |
| MEDIUM | CHANGELOG.md | 2559 | #### Add shared agentic workflow for Microsoft Fabric RTI MCP server | COMMENT |
| MEDIUM | CHANGELOG.md | 2687 | #### Add SST OpenCode shared agentic workflow and smoke test | COMMENT |
| MEDIUM | CHANGELOG.md | 2763 | #### Add temporary folder usage instructions to agentic workflow prompts | COMMENT |
| MEDIUM | CHANGELOG.md | 2872 | #### Remove push trigger from repo-tree-map agentic workflow | COMMENT |
| MEDIUM | CHANGELOG.md | 2904 | #### Update agentic CLI versions | COMMENT |
| MEDIUM | DEVGUIDE.md | 801 | command_name_orchestrator.go # Main orchestration | CODE |
| MEDIUM | README.md | 9 | - Reference: https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md | CODE |
| MEDIUM | README.md | 54 | - [Guardrails](#guardrails) | CODE |
| MEDIUM | README.md | 376 | See the [Peli's Agent Factory](https://github.com/github/gh-aw/blob/main/docs/src/content/docs/blog/2026-01-12-welcome-t | CODE |
| MEDIUM | README.md | 389 | > **Ready to learn GitHub Agentic Workflows hands-on?** The [**gh-aw-workshop**](https://github.com/githubnext/gh-aw-wor | CODE |
| MEDIUM | CONTRIBUTING.md | 175 | Load [https://github.com/github/gh-aw/.github/skills/agentic-workflows/SKILL.md](https://github.com/github/gh-aw/blob/ma | CODE |
| MEDIUM | cmd/gh-aw/capitalization_test.go | 14 | // - Use lowercase "agentic workflows" when referring generically to workflow files/functionality | COMMENT |
| MEDIUM | cmd/gh-aw/capitalization_test.go | 29 | // Define commands that should use lowercase "agentic workflows" (generic usage) | COMMENT |
| MEDIUM | cmd/gh-aw/capitalization_test.go | 55 | // MCP command Long description should use lowercase "agentic workflows" | COMMENT |
| MEDIUM | scratchpad/validation-refactoring.md | 99 | // Package workflow provides {domain} validation for agentic workflows. | COMMENT |
| MEDIUM | scratchpad/dev.md | 2938 | - [File Inlining and Runtime Imports](./file-inlining.md) - `{{#runtime-import}}` macro: file/URL content inclusion in w | CODE |
| MEDIUM | scratchpad/dev.md | 2987 | - v9.13 (2026-05-21): Maintenance tone scan — fixed 8 tone issues across 6 spec files: `serena-tools-analysis.md` (2 fix | CODE |
| MEDIUM | scratchpad/adding-new-engines.md | 211 | // MyEngine represents the My AI agentic engine | COMMENT |
| MEDIUM | scratchpad/string-sanitization-normalization.md | 86 | // Returns: "github-agentic-workflow" (default) | COMMENT |
| MEDIUM | …dr/34008-manifest-scoped-source-tracking-and-update.md | 65 | ### Update orchestration | COMMENT |
| MEDIUM | …eplace-pkg-cli-test-seams-with-dependency-injection.md | 1 | # ADR-34224: Replace mutable pkg/cli test seams with per-flow dependency injection | COMMENT |
| MEDIUM | …ackage-raw-action-workflow-yml-files-in-aw-manifest.md | 21 | #### Alternative 1: Treat `.yml` as another input to the agentic compilation pipeline | COMMENT |
| MEDIUM | docs/tests/copy-button.spec.ts | 8 | // Navigate to the agentic authoring page | COMMENT |
| MEDIUM | docs/tests/copy-button.spec.ts | 54 | // Navigate to the agentic authoring page | COMMENT |
| MEDIUM | docs/tests/copy-button.spec.ts | 106 | // Navigate to the agentic authoring page | COMMENT |
| MEDIUM | docs/slides/index.md | 94 | add-comment: # guardrails for write operations | CODE |
| MEDIUM | docs/src/content/docs/about.md | 11 | **GitHub Agentic Workflows** (`gh-aw`) is an open-source [GitHub CLI](https://cli.github.com/) extension from [GitHub](h | CODE |
| MEDIUM | docs/src/content/docs/patterns/deterministic-ops.md | 9 | GitHub Agentic Workflows can combine deterministic computation ([`steps:`](/gh-aw/reference/steps-jobs/#custom-steps-ste | CODE |
| MEDIUM | docs/src/content/docs/patterns/deterministic-ops.md | 82 | Deterministic steps can also be used for [Custom Trigger Filtering](/gh-aw/reference/triggers/#filtering-by-custom-steps | CODE |
| MEDIUM | docs/src/content/docs/patterns/monitor-ops.md | 10 | The [agentic-ops repository](https://github.com/githubnext/agentic-ops) provides the reference implementation for this a | CODE |
| MEDIUM | …ocs/specs/repository-package-manifest-specification.md | 212 | - workflows/review.md # agentic workflow — compiled on install | CODE |
| MEDIUM | docs/src/content/docs/specs/forecast-specification.md | 274 | # Forecast all agentic workflows in the current repository for the next month | COMMENT |
| MEDIUM | docs/src/content/docs/setup/cli.md | 14 | | [`gh aw init`](#init) | Set up your repository for agentic workflows | First time configuring a repo — creates skills, | CODE |
| MEDIUM | docs/src/content/docs/setup/cli.md | 22 | | [`gh aw logs`](#logs) | Download and analyze agentic workflow logs and artifacts | Debugging a past run by inspecting | CODE |
| MEDIUM | …docs/blog/2026-01-12-welcome-to-pelis-agent-factory.md | 31 | Peli's factory is a collection of [**automated agentic workflows**](https://gh.io/gh-aw) we use in practice. We have bui | CODE |
| MEDIUM | …docs/blog/2026-01-12-welcome-to-pelis-agent-factory.md | 57 | The factory becomes both an experiment and a reference collection - a living library of patterns that others can study, | CODE |
| MEDIUM | …s/src/content/docs/blog/2026-05-26-agent-of-the-day.md | 43 | **Curious about building workflows that watch your workflows?** Explore the full gh-aw project at [github/gh-aw](https:/ | CODE |
| MEDIUM | …s/src/content/docs/blog/2026-05-20-agent-of-the-day.md | 56 | **Want workflows that know when to quit while they're ahead?** Check out the [gh-aw project on GitHub](https://github.co | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-04-06-weekly-update.md | 52 | ## 🤖 Agent of the Week: agentic-observability-kit | COMMENT |
| MEDIUM | docs/src/content/docs/blog/2026-04-06-weekly-update.md | 62 | → [View the workflow on GitHub](https://github.com/github/gh-aw/blob/main/.github/workflows/agentic-observability-kit.md | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-06-22-weekly-update.md | 23 | [PR #40698](https://github.com/github/gh-aw/pull/40698) expands the `gh-aw-detection` feature flag from 20% (43 workflow | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-06-22-weekly-update.md | 23 | [PR #40698](https://github.com/github/gh-aw/pull/40698) expands the `gh-aw-detection` feature flag from 20% (43 workflow | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-06-29-weekly-update.md | 15 | [PR #42137](https://github.com/github/gh-aw/pull/42137) ships a project-scoped GitHub Copilot Canvas extension — a GitHu | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-06-29-weekly-update.md | 15 | [PR #42137](https://github.com/github/gh-aw/pull/42137) ships a project-scoped GitHub Copilot Canvas extension — a GitHu | CODE |
| MEDIUM | docs/src/content/docs/blog/2026-06-29-weekly-update.md | 26 | Paired with this, [PR #42147](https://github.com/github/gh-aw/pull/42147) adds a new **`create-canvas` skill** that guid | CODE |
| 532 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | debug.md | 31 | ## Step 1: Install GitHub Agentic Workflows CLI Extension | COMMENT |
| LOW | debug.md | 65 | ## Step 2: Debug the Workflow Failure | COMMENT |
| LOW | debug.md | 85 | ## Step 3: Apply Fixes | COMMENT |
| LOW | debug.md | 98 | ## Step 4: Commit and Push Changes | COMMENT |
| LOW | install.md | 13 | ## Step 1: Install gh-aw CLI Extension | COMMENT |
| LOW | install.md | 35 | ## Step 2: Initialize Repository for Agentic Workflows | COMMENT |
| LOW | install.md | 53 | ## Step 3: Review Changes | COMMENT |
| LOW | create.md | 5 | ## Step 1: Install GitHub Agentic Workflows CLI Extension | COMMENT |
| LOW | create.md | 39 | ## Step 2: Create the Workflow or do Other Actions | COMMENT |
| LOW | create.md | 112 | ## Step 3: Review Changes | COMMENT |
| LOW | create.md | 144 | ## Step 4: Commit and Push Changes | COMMENT |
| LOW | CONTRIBUTING.md | 47 | ### Step 1: Analyze with an Agent (for bug reports) | COMMENT |
| LOW | CONTRIBUTING.md | 57 | ### Step 2: Open an Issue with Your Agentic Plan | COMMENT |
| LOW | CONTRIBUTING.md | 108 | ### Step 3: Discuss and Refine with the Team | COMMENT |
| LOW | CONTRIBUTING.md | 116 | ### Step 4: A Core Team Member Implements the PR | COMMENT |
| LOW | optimize.md | 31 | ## Step 1: Install GitHub Agentic Workflows CLI Extension | COMMENT |
| LOW | optimize.md | 65 | ## Step 2: Optimize Token Consumption | COMMENT |
| LOW | optimize.md | 83 | ## Step 3: Apply Optimizations | COMMENT |
| LOW | optimize.md | 96 | ## Step 4: Commit and Push Changes | COMMENT |
| LOW | package.md | 15 | ## Step 1: Discover Package Contents | COMMENT |
| LOW | package.md | 29 | ## Step 2: Standardize Structure | COMMENT |
| LOW | package.md | 40 | ## Step 3: Create `aw.yml` Package Manifest | COMMENT |
| LOW | package.md | 78 | ## Step 4: Dependency Cleanup for Reusability | COMMENT |
| LOW | package.md | 89 | ## Step 5: Update `README.md` for Consumers | COMMENT |
| LOW | package.md | 103 | ## Step 6: Validate and Deliver | COMMENT |
| LOW⚡ | test-setup-local.sh | 18 | # Step 1: Check if we're in the right directory | COMMENT |
| LOW⚡ | test-setup-local.sh | 26 | # Step 2: Build the actions if js/ directory doesn't exist | COMMENT |
| LOW⚡ | test-setup-local.sh | 39 | # Step 3: Verify js/ directory has files | COMMENT |
| LOW⚡ | test-setup-local.sh | 47 | # Step 4: Create a temporary destination directory | COMMENT |
| LOW⚡ | test-setup-local.sh | 52 | # Step 5: Run setup.sh | COMMENT |
| LOW⚡ | test-setup-local.sh | 66 | # Step 6: Verify files were copied | COMMENT |
| LOW⚡ | test-setup-local.sh | 76 | # Step 7: Check output file | COMMENT |
| LOW⚡ | test-setup-local.sh | 82 | # Step 8: List some of the copied files | COMMENT |
| LOW⚡ | test-setup-local.sh | 87 | # Step 9: Cleanup | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 51 | ### Step 1: Analyze Current Structure | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 76 | ### Step 2: Group by Domain | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 91 | ### Step 3: Create New Files | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 131 | ### Step 4: Move Functions | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 159 | ### Step 5: Reorganize Tests | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 188 | ### Step 6: Update Documentation | COMMENT |
| LOW | scratchpad/validation-refactoring.md | 205 | ### Step 7: Verify No Functional Changes | COMMENT |
| LOW | scratchpad/end-to-end-feature-testing.md | 18 | ### Step 1: Instruct GitHub Copilot Agent to Modify dev.md | COMMENT |
| LOW | scratchpad/end-to-end-feature-testing.md | 44 | ### Step 2: Trigger the Dev Workflow | COMMENT |
| LOW | scratchpad/end-to-end-feature-testing.md | 66 | ### Step 3: Monitor the Dev Workflow Execution | COMMENT |
| LOW | scratchpad/end-to-end-feature-testing.md | 81 | ### Step 4: Review Dev Hawk's Analysis | COMMENT |
| LOW | scratchpad/end-to-end-feature-testing.md | 99 | ### Step 5: Iterate Based on Feedback | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 197 | ### Step 1: Create Engine File | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 236 | ### Step 2: Implement Required Secrets | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 262 | ### Step 3: Implement Installation Steps | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 321 | ### Step 4: Implement Execution Steps | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 397 | ### Step 5: Implement MCP Configuration | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 438 | ### Step 6: Implement Log Parsing (Optional) | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 461 | ### Step 7: Register Engine | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 482 | ### Step 8: Add Engine Constant (Optional) | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 493 | ### Step 9: Add Tests | COMMENT |
| LOW | scratchpad/adding-new-engines.md | 566 | ### Step 10: Update Documentation | COMMENT |
| LOW | scratchpad/actions.md | 787 | #### Step 1: Register Script with Action Path | COMMENT |
| LOW | scratchpad/actions.md | 799 | #### Step 2: Compile with Action Mode | COMMENT |
| LOW | scratchpad/actions.md | 836 | #### Step 3: Output Comparison | COMMENT |
| LOW⚡ | scratchpad/html-entity-mention-bypass-fix.md | 32 | // Step 1: Normalize Unicode (NFC) | COMMENT |
| 520 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | specs/aw-harness.md | 307 | > # ── Harness config (optional) ─────────────────────────────── | CODE |
| MEDIUM⚡ | scripts/check-stale-lock-files_test.sh | 146 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | scripts/check-stale-lock-files_test.sh | 148 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 39 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 53 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 56 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 72 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 74 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 88 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 90 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 107 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 109 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 130 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 132 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 170 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 172 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 186 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 188 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 207 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | scripts/check-stale-lock-files_test.sh | 209 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 329 | # ── Helper: count records in a JSONL file ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 336 | # ── If FileStorage is available, attempt DataFlow operators ────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 341 | # ── 1. Text length filter ───────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 353 | # ── 2. Alpha-ratio filter ───────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 365 | # ── 3. Near-duplicate removal ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 384 | # ── Save output ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 396 | # ── Fallback: lightweight Python pipeline (no DataFlow operators) ───────────── | COMMENT |
| MEDIUM | .github/workflows/dataflow-pr-discussion-dataset.md | 226 | # ── Discussions ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/dataflow-pr-discussion-dataset.md | 248 | # ── Pull Requests ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/dataflow-pr-discussion-dataset.md | 311 | # ── Load DataFlow storage ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/dataflow-pr-discussion-dataset.md | 438 | # ── Write stats ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/upgrade-test.yml | 66 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/upgrade-test.yml | 87 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 26 | // ── Input-definition types ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 48 | // ── Config type ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 85 | // ── Per-call message type ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 118 | // ── Resolved temporary IDs ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 166 | // ── sanitizeContent ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 200 | // ── Handler and factory function types ───────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/js/types/safe-output-script.d.ts | 254 | // ── Globals available in the script body ──────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 41 | # ── Test 1: Core folders and root files are saved ──────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 66 | # ── Test 2: Absent items are skipped without error ─────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 85 | # ── Test 3: Empty env vars → nothing saved, exits 0 ───────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 100 | # ── Test 4: Re-run clears stale snapshot (idempotent) ──────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 117 | # ── Test 5: Unset env vars → graceful no-op ────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/save_base_github_folders_test.sh | 130 | # ── Summary ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | actions/setup/sh/print_firewall_logs_test.sh | 36 | # ── Test 1: Script syntax is valid ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | actions/setup/sh/print_firewall_logs_test.sh | 41 | # ── Test 2: Unknown argument exits 1 ──────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | actions/setup/sh/print_firewall_logs_test.sh | 50 | # ── Test 3: AWF not installed prints informational message ────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/print_firewall_logs_test.sh | 67 | # ── Test 4: --rootless flag is accepted without error ─────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/print_firewall_logs_test.sh | 84 | # ── Test 5: FIREWALL_DIR is computed as dirname of AWF_LOGS_DIR ───────────── | COMMENT |
| MEDIUM | actions/setup/sh/print_firewall_logs_test.sh | 136 | # ── Test 8: GITHUB_STEP_SUMMARY guard — no error when variable is unset ────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 48 | # ── Test 1: No .git/config anywhere (no-op, exit 0) ───────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 58 | # ── Test 2: Removes [credential] section ──────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 73 | # ── Test 3: Removes http.extraheader ──────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 85 | # ── Test 4: Strips credentials from remote URL ────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 98 | # ── Test 5: Recursively finds repo nested inside workspace ────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 115 | # ── Test 6: Finds git repo in /tmp ────────────────────────────────────────── | COMMENT |
| MEDIUM | actions/setup/sh/clean_git_credentials_test.sh | 130 | # ── Test 7: Config file remains valid after all cleanups ──────────────────── | COMMENT |
| 132 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/playwright-cli/SKILL.md | 39 | playwright-cli fill e5 "user@example.com" --submit | CODE |
| LOW | .claude/skills/playwright-cli/SKILL.md | 330 | playwright-cli fill e1 "user@example.com" | CODE |
| LOW | …de/skills/playwright-cli/references/test-generation.md | 21 | playwright-cli fill e1 "user@example.com" | CODE |
| LOW | …de/skills/playwright-cli/references/test-generation.md | 23 | # await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com'); | COMMENT |
| LOW | …de/skills/playwright-cli/references/test-generation.md | 44 | await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com'); | CODE |
| LOW | …de/skills/playwright-cli/references/test-generation.md | 118 | await expect(page.getByRole('textbox', { name: 'Email' })).toHaveValue('user@example.com'); | CODE |
| LOW | …laude/skills/playwright-cli/references/running-code.md | 223 | await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com'); | CODE |
| LOW⚡ | …aude/skills/playwright-cli/references/storage-state.md | 238 | playwright-cli fill e1 "user@example.com" | CODE |
| LOW | …kills/playwright-cli/references/spec-driven-testing.md | 180 | playwright-cli fill e3 "John Doe" # -> page.getByRole('textbox', {...}).fill(...) | CODE |
| LOW | …kills/playwright-cli/references/spec-driven-testing.md | 199 | // 2. Type 'John Doe' into the username field | COMMENT |
| LOW | …kills/playwright-cli/references/spec-driven-testing.md | 200 | await page.getByRole('textbox', { name: 'username' }).fill('John Doe'); | CODE |
| LOW | …skills/playwright-cli/references/session-management.md | 17 | playwright-cli -s=auth fill e1 "user@example.com" | CODE |
| LOW⚡ | scripts/check-stale-lock-files_test.sh | 153 | git -C "$T7" config user.email "test@test.com" | CODE |
| LOW | scripts/check-stale-lock-files_test.sh | 23 | git -C "$repo_dir" config user.email "test@test.com" | CODE |
| LOW | pkg/cli/compile_integration_test.go | 352 | gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com") | CODE |
| LOW | pkg/cli/compile_integration_test.go | 1404 | gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com") | CODE |
| LOW | pkg/cli/poutine_integration_test.go | 25 | gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com") | CODE |
| LOW | pkg/cli/poutine_integration_test.go | 106 | gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com") | CODE |
| LOW | pkg/cli/copilot_billing_check_test.go | 41 | AuthToken: "fake-token-for-test", | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 7 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 7 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 8 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 8 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 9 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 9 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 10 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 10 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 11 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 11 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 12 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 12 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 13 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 13 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 14 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 14 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 15 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 15 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 16 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 16 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 17 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 17 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 18 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 18 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 19 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 19 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 20 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 20 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 21 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 22 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 22 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 23 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 23 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 24 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 24 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 25 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 25 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 26 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 26 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW⚡ | pkg/cli/workflows/test-long.md | 27 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| 507 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/src/content/docs/reference/glossary.md | 446 | A field available on `create-issue:`, `add-comment:`, and `create-pull-request:` safe outputs that strips wrapping backt | CODE |
| HIGH | docs/src/content/docs/reference/glossary.md | 1383 | A [MultiRepoOps](#multirepoops) topology where workflows run from a separate dedicated automation repository targeting y | CODE |
| HIGH | …c/content/docs/reference/safe-outputs-pull-requests.md | 130 | footer: false # omit AI-generated footer from body updates (default: true) | CODE |
| HIGH | …c/content/docs/reference/safe-outputs-pull-requests.md | 251 | footer: true # add AI-generated footer (default: true) | CODE |
| HIGH⚡ | docs/src/content/docs/reference/frontmatter-full.md | 5820 | # Controls when AI-generated footer is added to the review body. Accepts boolean | COMMENT |
| HIGH⚡ | docs/src/content/docs/reference/frontmatter-full.md | 5826 | # Format 1: Controls whether AI-generated footer is added to the review body. true | COMMENT |
| HIGH⚡ | docs/src/content/docs/reference/frontmatter-full.md | 5830 | # Format 2: Controls when AI-generated footer is added to the review body: | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 3656 | # Controls whether AI-generated footer is added to the managed comment. Defaults | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 4032 | # Controls whether AI-generated footer is added to the issue. When false, the | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 4648 | # Controls whether AI-generated footer is added to the discussion. When false, the | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 4843 | # Controls whether AI-generated footer is added when updating the discussion body. | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 5234 | # Controls whether AI-generated footer is added to the comment. When false, the | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 5512 | # Controls whether AI-generated footer is added to the pull request. When false, | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 6111 | # Controls whether AI-generated footer is added to the reply body. When false, the | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 7492 | # Controls whether AI-generated footer is added when updating the issue body. When | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 7606 | # Controls whether AI-generated footer is added when updating the pull request | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 9013 | # Controls whether AI-generated footer is added when updating the release body. | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 9411 | # Custom footer message template for AI-generated content. Available placeholders: | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 9533 | # @mentions in AI-generated content are allowed or escaped. | COMMENT |
| HIGH | docs/src/content/docs/reference/frontmatter-full.md | 9583 | # AI-generated footer content from all created/updated entities (issues, PRs, | COMMENT |
| HIGH | docs/src/content/docs/reference/safe-outputs.md | 291 | footer: false # omit AI-generated footer (default: true) | CODE |
| HIGH | docs/src/content/docs/reference/safe-outputs.md | 908 | footer: false # omit AI-generated footer from review body (default: true) | CODE |
| HIGH | .github/aw/messages.md | 28 | ### Footer messages (appended to every AI-generated comment/issue/PR) | COMMENT |
| HIGH | .github/aw/messages.md | 54 | ### Body headers (prepended to every AI-generated message body) | COMMENT |
| HIGH | .github/aw/safe-outputs-content.md | 25 | footer: false # Optional: omit AI-generated footer while preserving XML markers (default: true) | CODE |
| HIGH | .github/aw/safe-outputs-content.md | 96 | footer: false # Optional: omit AI-generated footer while preserving XML markers (default: true) | CODE |
| HIGH | .github/aw/memory.md | 267 | footer: false # Optional: omit AI-generated footer (default: true) | CODE |
| HIGH | .github/workflows/copilot-agent-analysis.md | 223 | _Generated by Copilot Agent Analysis (Run: [run_id])_ | CODE |
| HIGH | .github/workflows/pr-description-caveman.md | 4 | description: Rewrites a merged PR description with a structured, considered summary optimised for downstream agentic ana | CODE |
| HIGH | .github/workflows/pr-description-caveman.lock.yml | 26 | # Rewrites a merged PR description with a structured, considered summary optimised for downstream agentic analysis. Proc | COMMENT |
| HIGH | .github/workflows/pr-description-caveman.lock.yml | 1420 | WORKFLOW_DESCRIPTION: "Rewrites a merged PR description with a structured, considered summary optimised for do | CODE |
| HIGH | .github/workflows/pr-nitpick-reviewer.md | 360 | ### Auto-generated Code | COMMENT |
| HIGH | .github/workflows/copilot-cli-deep-research.md | 431 | _Generated by Copilot CLI Deep Research (Run: ${{ github.run_id }})_ | CODE |
| HIGH | .github/workflows/copilot-pr-prompt-analysis.md | 273 | _Generated by Copilot PR Prompt Analysis (Run: ${{ github.run_id }})_ | CODE |
| HIGH | .github/workflows/discussion-task-miner.lock.yml | 26 | # Scans AI-generated discussions to extract actionable code quality improvement tasks | COMMENT |
| HIGH | .github/workflows/copilot-pr-merged-report.md | 211 | _Generated by Copilot PR Merged Report (Run: [${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/ | CODE |
| HIGH | .github/workflows/copilot-pr-merged-report.md | 251 | _Generated by Copilot PR Merged Report (Run: [${{ github.run_id }}](...))_ | CODE |
| HIGH | pkg/cli/mcp_secrets.go | 49 | // If we get a 403 error, ignore it as requested | COMMENT |
| HIGH | pkg/workflow/markdown_code_region_balancer_fuzz_test.go | 20 | // 4. Common AI-generated patterns are properly handled | COMMENT |
| HIGH | pkg/workflow/markdown_code_region_balancer_fuzz_test.go | 81 | // AI-generated nested markdown examples (common error pattern) | COMMENT |
| HIGH | pkg/workflow/update_release.go | 12 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is added. When false, visi | CODE |
| HIGH | pkg/workflow/reply_to_pr_review_comment.go | 15 | Footer *string `yaml:"footer,omitempty"` // Whether to add AI-generated footer to replies | CODE |
| HIGH | pkg/workflow/create_discussion.go | 28 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is ad | CODE |
| HIGH | pkg/workflow/create_issue.go | 28 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated foo | CODE |
| HIGH | pkg/workflow/update_discussion.go | 19 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is added. When fa | CODE |
| HIGH | pkg/workflow/create_pull_request.go | 56 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-g | CODE |
| HIGH | pkg/workflow/update_pull_request.go | 20 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is added. When | CODE |
| HIGH | pkg/workflow/add_comment.go | 27 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is | CODE |
| HIGH | pkg/workflow/update_issue.go | 18 | Footer *string `yaml:"footer,omitempty"` // Controls whether AI-generated footer is added. | CODE |
| HIGH⚡ | pkg/workflow/test_data/sample_codex_log.txt | 163 | "text": "{\"total_count\":20,\"incomplete_results\":false,\"items\":[{\"id\":3316382552,\"number\":14,\"state\":\" | CODE |
| HIGH⚡ | pkg/workflow/test_data/sample_codex_log.txt | 163 | "text": "{\"total_count\":20,\"incomplete_results\":false,\"items\":[{\"id\":3316382552,\"number\":14,\"state\":\" | CODE |
| HIGH | pkg/workflow/test_data/sample_claude_log.txt | 215 | [{"type":"system","subtype":"init","cwd":"/home/runner/work/gh-aw/gh-aw","session_id":"29d324d8-1a92-43c6-8740-babc2875a | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | test-setup-local.sh | 18 | # Step 1: Check if we're in the right directory | COMMENT |
| LOW⚡ | test-setup-local.sh | 26 | # Step 2: Build the actions if js/ directory doesn't exist | COMMENT |
| LOW⚡ | test-setup-local.sh | 39 | # Step 3: Verify js/ directory has files | COMMENT |
| LOW⚡ | test-setup-local.sh | 47 | # Step 4: Create a temporary destination directory | COMMENT |
| LOW⚡ | test-setup-local.sh | 52 | # Step 5: Run setup.sh | COMMENT |
| LOW⚡ | test-setup-local.sh | 66 | # Step 6: Verify files were copied | COMMENT |
| LOW⚡ | test-setup-local.sh | 76 | # Step 7: Check output file | COMMENT |
| LOW⚡ | test-setup-local.sh | 82 | # Step 8: List some of the copied files | COMMENT |
| LOW⚡ | test-setup-local.sh | 87 | # Step 9: Cleanup | COMMENT |
| LOW | .github/workflows/daily-fact.lock.yml | 378 | #### Step 0: Load Memory | COMMENT |
| LOW⚡ | .github/workflows/daily-fact.lock.yml | 445 | #### Step 3: Save to Memory | COMMENT |
| LOW | actions/setup/sh/check_mcp_servers.sh | 150 | # Step 1: Send ping to verify basic connectivity | COMMENT |
| LOW | actions/setup/sh/check_mcp_servers.sh | 164 | # Step 2: Send MCP initialize request, capturing response headers for Mcp-Session-Id | COMMENT |
| LOW | actions/setup/sh/check_mcp_servers.sh | 180 | # Step 3: Send tools/list, including Mcp-Session-Id header if returned by initialize | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 119 | # Step 1: Validate config file exists | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 124 | # Step 2: Check if server exists | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 129 | # Step 3: Extract server configuration | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 135 | # Step 4: Validate server has URL | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 141 | # Step 5: Validate server type | COMMENT |
| LOW⚡ | actions/setup/sh/validate_gatewayed_server.sh | 146 | # Step 6: Validate URL points to gateway | COMMENT |
| LOW | pkg/cli/compile_schedule_calendar_test.go | 332 | // Step 1: scatter the fuzzy expression to a real cron string. | COMMENT |
| LOW⚡ | pkg/cli/compile_schedule_calendar_test.go | 343 | // Step 2: parse the scattered cron with parseCronSchedule. | COMMENT |
| LOW⚡ | pkg/cli/compile_schedule_calendar_test.go | 352 | // Step 3: buildScheduleGrid should register at least one slot. | COMMENT |
| LOW | pkg/cli/compile_schedule_calendar_test.go | 369 | // Step 4: displayScheduleCalendar should produce output referencing the hour. | COMMENT |
| LOW⚡ | pkg/cli/logs_json_clean_test.go | 94 | // Step 1: Build logs data (what happens in the function) | COMMENT |
| LOW⚡ | pkg/cli/logs_json_clean_test.go | 97 | // Step 2: Capture both stdout and stderr | COMMENT |
| LOW⚡ | pkg/cli/logs_json_clean_test.go | 116 | // Step 3: Output JSON FIRST (as our fix does) | COMMENT |
| LOW⚡ | pkg/cli/logs_json_clean_test.go | 119 | // Step 4: Then output stderr message (as our fix does) | COMMENT |
| LOW⚡ | pkg/cli/checks_command.go | 157 | // Step 1: Resolve head SHA from PR (skipped when caller provides it). | COMMENT |
| LOW⚡ | pkg/cli/checks_command.go | 166 | // Step 2: Fetch check runs | COMMENT |
| LOW⚡ | pkg/cli/checks_command.go | 174 | // Step 3: Fetch commit statuses | COMMENT |
| LOW⚡ | pkg/cli/add_package_manifest.go | 537 | // Step 1: resolve manifest skills first (explicit dirs). | COMMENT |
| LOW⚡ | pkg/cli/add_package_manifest.go | 543 | // Step 2: always auto-scan and append any skills not already in the manifest. | COMMENT |
| LOW⚡ | pkg/cli/codemod_difc_proxy.go | 35 | // Step 1: remove features.difc-proxy | COMMENT |
| LOW⚡ | pkg/cli/codemod_difc_proxy.go | 42 | // Step 2: add integrity-proxy: false to tools.github if needed | COMMENT |
| LOW | pkg/cli/trial_confirmation.go | 138 | // Step 1: Repository creation/reuse | COMMENT |
| LOW | pkg/cli/trial_confirmation.go | 149 | // Step 2: Clone contents (only in clone-repo mode) | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 216 | // Step 1: Compile to generate the full lock file + manifest. | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 230 | // Step 2: Compile the identical workflow again. The lock file from step 1 acts | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 256 | // Step 1: Establish the baseline manifest with a normal compile. | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 269 | // Step 2: Re-compile. No secrets were added so this must succeed. | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 513 | // Step 1: Compile to generate the lock file + manifest. | COMMENT |
| LOW | pkg/cli/compile_safe_update_integration_test.go | 527 | // Step 2: Compile again. The lock file from step 1 serves as the prior manifest. | COMMENT |
| LOW | pkg/cli/trial_runner.go | 47 | // Step 0: Determine workflow mode (mutual exclusion is enforced by Cobra) | COMMENT |
| LOW | pkg/cli/trial_runner.go | 100 | // Step 1: Determine host repository slug | COMMENT |
| LOW | pkg/cli/trial_runner.go | 138 | // Step 2: Create or reuse host repository | COMMENT |
| LOW | pkg/cli/codemod_run_install_scripts.go | 68 | // Step 1: Find the top-level run-install-scripts line | COMMENT |
| LOW⚡ | pkg/cli/codemod_run_install_scripts.go | 95 | // Step 2: Detect the primary indentation unit used in the frontmatter | COMMENT |
| LOW⚡ | pkg/cli/codemod_run_install_scripts.go | 98 | // Step 3: Find the runtimes: block (top-level key) | COMMENT |
| LOW | pkg/cli/codemod_run_install_scripts.go | 118 | // Step 4: Find node: as a direct child of runtimes: | COMMENT |
| LOW | pkg/cli/codemod_run_install_scripts.go | 154 | // Step 5: node: exists – inject run-install-scripts right after node: | COMMENT |
| LOW | pkg/cli/trial_helpers.go | 49 | // Step 3: Clone host repository to local temp directory | COMMENT |
| LOW⚡ | pkg/cli/trial_helpers.go | 62 | // Step 4: Create trials directory | COMMENT |
| LOW⚡ | pkg/cli/trial_helpers.go | 67 | // Step 5: Run trials for each workflow | COMMENT |
| LOW | pkg/cli/trial_helpers.go | 165 | // Step 6: Save combined results for multi-workflow trials | COMMENT |
| LOW | pkg/cli/logs_copilot_flattening_integration_test.go | 24 | // Step 1: Simulate downloaded artifacts structure (before flattening) | COMMENT |
| LOW | pkg/cli/logs_copilot_flattening_integration_test.go | 63 | // Step 2: Flatten the artifact (mimics flattenAgentOutputsArtifact) | COMMENT |
| LOW | pkg/cli/logs_copilot_flattening_integration_test.go | 82 | // Step 3: Test that findAgentLogFile can find the session log after flattening | COMMENT |
| LOW | pkg/cli/logs_copilot_flattening_integration_test.go | 104 | // Step 1: Simulate downloaded artifacts structure (before flattening) | COMMENT |
| LOW | pkg/cli/logs_copilot_flattening_integration_test.go | 138 | // Step 2: Flatten the artifact | COMMENT |
| 72 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install-gh-aw.sh | 29 | # Check if INPUT_VERSION is set (GitHub Actions context) | COMMENT |
| LOW⚡ | install-gh-aw.sh | 86 | # Check if HOME is set | COMMENT |
| LOW⚡ | install-gh-aw.sh | 92 | # Check if curl is available | COMMENT |
| LOW⚡ | install-gh-aw.sh | 98 | # Check if sha256sum or shasum is available (for checksum verification) | COMMENT |
| LOW | install-gh-aw.sh | 314 | # Check if binary already exists | COMMENT |
| LOW | cmd/gh-aw/main.go | 437 | gh aw run daily-perf-improver --json # Output results in JSON format`, | CODE |
| LOW | .serena/project.yml | 94 | # Set this to [] to disable base modes for this project. | COMMENT |
| LOW | .serena/project.yml | 95 | # Set this to a list of mode names to always include the respective modes for this project. | COMMENT |
| LOW | scripts/generate-video-posters.sh | 14 | # Check if ffmpeg is installed | COMMENT |
| LOW | scripts/delete-old-copilot-branches.sh | 120 | # Check if commit is at least 7 days old | COMMENT |
| LOW | scripts/delete-old-copilot-branches.sh | 152 | # Check if we've reached the max branches limit | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 69 | # Check if agent job has write permissions | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 93 | # Check if handler has API calls | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 95 | # Check if validation appears before API calls | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 123 | # Check if handler enforces max limits using any recognized pattern | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 150 | # Check if handler has body/content fields | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 180 | # Check if handler supports target-repo | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 211 | # Check if handler throws errors | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 236 | # Check if handler adds footers | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 350 | # Check if standard handlers exist | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 368 | # Check if permission computation file exists and is well-formed | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 387 | # Check if safe outputs config generation file exists with schema functions | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 399 | # Check if static schemas file exists (embedded JSON) | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 411 | # Check if safe_outputs_config.go has documentation about schema architecture | COMMENT |
| LOW | scripts/check-safe-outputs-conformance.sh | 1201 | # Check if the gateway handler skips tools not present in config (indirectly validates zero-max) | COMMENT |
| LOW | scripts/build-release.sh | 41 | # Check if platform is supported | COMMENT |
| LOW | .github/workflows/daily-hippo-learn.lock.yml | 516 | run: "# Symlink .hippo into cache-memory so the SQLite store persists across runs.\n# All writes to .hippo/ land | CODE |
| LOW | .github/workflows/copilot-pr-merged-report.lock.yml | 477 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | .github/workflows/copilot-agent-analysis.lock.yml | 593 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | .github/workflows/super-linter.lock.yml | 1756 | # Check if there are actual errors (not just the header) | COMMENT |
| LOW | .github/workflows/docs-noob-tester.lock.yml | 565 | run: "MAX_WAIT=135 # 45 attempts × 3s = 135s max wait\nWAITED=0\nuntil (echo > /dev/tcp/127.0.0.1/4321) > /dev/ | CODE |
| LOW | .github/workflows/copilot-opt.lock.yml | 525 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/session-data\nmkdir -p /tmp/gh-aw/agent/session-dat | CODE |
| LOW | .github/workflows/copilot-opt.lock.yml | 533 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | .github/workflows/deep-report.lock.yml | 646 | # Check if cached data exists from today | COMMENT |
| LOW | .github/workflows/deep-report.lock.yml | 733 | # Check if there are more pages | COMMENT |
| LOW | .github/workflows/deep-report.lock.yml | 737 | # Check if we've reached the requested count | COMMENT |
| LOW | .github/workflows/deep-report.lock.yml | 787 | # Check if cached data exists from today | COMMENT |
| LOW | .github/workflows/daily-news.lock.yml | 618 | run: "set -e\n\n# Create directories\nmkdir -p /tmp/gh-aw/agent/daily-news-data\nmkdir -p /tmp/gh-aw/repo-memory | CODE |
| LOW⚡ | .github/workflows/prompt-clustering-analysis.lock.yml | 576 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | …thub/workflows/dataflow-pr-discussion-dataset.lock.yml | 625 | # Check if cached data exists from today | COMMENT |
| LOW | …thub/workflows/dataflow-pr-discussion-dataset.lock.yml | 712 | # Check if there are more pages | COMMENT |
| LOW | …thub/workflows/dataflow-pr-discussion-dataset.lock.yml | 716 | # Check if we've reached the requested count | COMMENT |
| LOW | .github/workflows/daily-issues-report.lock.yml | 617 | # Check if cached data exists from today | COMMENT |
| LOW | .github/workflows/copilot-session-insights.lock.yml | 571 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/session-data\nmkdir -p /tmp/gh-aw/agent/session-dat | CODE |
| LOW | .github/workflows/copilot-pr-nlp-analysis.lock.yml | 573 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | .github/workflows/copilot-pr-prompt-analysis.lock.yml | 546 | run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Get | CODE |
| LOW | .github/workflows/install.yml | 134 | # Check if binary exists | COMMENT |
| LOW | .github/workflows/install.yml | 142 | # Check if binary is executable | COMMENT |
| LOW | …thub/workflows/daily-multi-device-docs-tester.lock.yml | 586 | run: "PID_FILE=\"/tmp/gh-aw/agent/docs-server-$EXPR_GITHUB_RUN_ID.pid\"\nLOG_FILE=\"/tmp/gh-aw/agent/docs-server | CODE |
| LOW | .github/workflows/ci.yml | 990 | # Check if the workflow has relative imports | COMMENT |
| LOW | .github/workflows/hippo-embed.lock.yml | 514 | run: "# Symlink .hippo into cache-memory so the SQLite store persists across runs.\n# All writes to .hippo/ land | CODE |
| LOW | .github/workflows/cgo.yml | 149 | # Check if tests failed by looking at JSON output | COMMENT |
| LOW | .github/workflows/cgo.yml | 1402 | # Check if the failure was due to context deadline (expected) | COMMENT |
| LOW | .github/workflows/cgo.yml | 2099 | # Check if lock file was generated | COMMENT |
| LOW | actions/setup-cli/install.sh | 29 | # Check if INPUT_VERSION is set (GitHub Actions context) | COMMENT |
| LOW⚡ | actions/setup-cli/install.sh | 86 | # Check if HOME is set | COMMENT |
| LOW⚡ | actions/setup-cli/install.sh | 92 | # Check if curl is available | COMMENT |
| LOW⚡ | actions/setup-cli/install.sh | 98 | # Check if sha256sum or shasum is available (for checksum verification) | COMMENT |
| LOW | actions/setup-cli/install.sh | 314 | # Check if binary already exists | COMMENT |
| LOW | actions/setup-cli/install_test.sh | 66 | # Check if script references INPUT_VERSION | COMMENT |
| 32 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install-gh-aw.sh | 308 | # Create the installation directory if it doesn't exist | COMMENT |
| MEDIUM | scripts/test-build-release.sh | 12 | # Create a temporary directory for testing | COMMENT |
| MEDIUM | scripts/convert-astro-to-gfm.sh | 21 | # Create a temporary file | COMMENT |
| MEDIUM | .github/workflows/daily-experiment-report.lock.yml | 522 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/stale-repo-identifier.lock.yml | 562 | # Create a virtual environment for proper package isolation (avoids --break-system-packages) | COMMENT |
| MEDIUM | …thub/workflows/github-mcp-structural-analysis.lock.yml | 531 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/python-data-charts.lock.yml | 555 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/detection-analysis-report.lock.yml | 560 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/daily-news.lock.yml | 599 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM⚡ | .github/workflows/prompt-clustering-analysis.lock.yml | 578 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM⚡ | .github/workflows/prompt-clustering-analysis.lock.yml | 580 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/prompt-clustering-analysis.lock.yml | 595 | run: "# Create output directory for full PR data\nmkdir -p /tmp/gh-aw/agent/prompt-cache/pr-full-data\n\n# Downl | CODE |
| MEDIUM | .github/workflows/daily-security-observability.lock.yml | 572 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/daily-security-observability.lock.yml | 584 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/daily-performance-summary.lock.yml | 530 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/audit-workflows.lock.yml | 627 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/daily-issues-report.lock.yml | 670 | # Create a virtual environment for proper package isolation (avoids --break-system-packages) | COMMENT |
| MEDIUM | .github/workflows/daily-issues-report.lock.yml | 713 | # Create a virtual environment for proper package isolation (avoids --break-system-packages) | COMMENT |
| MEDIUM | .github/workflows/daily-repo-chronicle.lock.yml | 524 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/portfolio-analyst.lock.yml | 521 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/daily-code-metrics.lock.yml | 593 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/copilot-session-insights.lock.yml | 575 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/api-consumption-report.lock.yml | 806 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/org-health-report.lock.yml | 529 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/weekly-issue-summary.lock.yml | 528 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/copilot-pr-nlp-analysis.lock.yml | 553 | run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /t | CODE |
| MEDIUM | .github/workflows/copilot-pr-nlp-analysis.lock.yml | 565 | run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol | CODE |
| MEDIUM | .github/workflows/format-and-commit.yml | 69 | # Create a unique branch name | COMMENT |
| MEDIUM | .github/workflows/agentics-maintenance.yml | 24 | # This file defines the generated agentic maintenance workflow for this repository. | COMMENT |
| MEDIUM | .github/workflows/cgo.yml | 1612 | # Create a test script using the MCP Go SDK | COMMENT |
| MEDIUM | actions/setup-cli/install.sh | 308 | # Create the installation directory if it doesn't exist | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 62 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 100 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 133 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 171 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 209 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 271 | # Create a temporary test socket and symlink | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 383 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/resolve_docker_socket_gid_test.sh | 420 | # Create a temporary test socket | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 92 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 119 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 145 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 172 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 199 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/start_mcp_gateway_test.sh | 226 | # Create a modified script that uses our fake home | COMMENT |
| MEDIUM | actions/setup/sh/convert_gateway_config_codex_test.sh | 22 | # Create the output directory the script writes to | COMMENT |
| MEDIUM | actions/setup/sh/setup_cache_memory_git.sh | 78 | # Create an empty initial commit as the trusted baseline for all branches | COMMENT |
| MEDIUM | actions/setup/sh/convert_gateway_config_codex.sh | 82 | # Create the TOML configuration | COMMENT |
| MEDIUM | pkg/cli/codemod_agent_session_test.go | 85 | create-agent-task: # Create a new agent task | CODE |
| MEDIUM | pkg/cli/codemod_agent_session_test.go | 104 | assert.Contains(t, result, "create-agent-session: # Create a new agent task") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .golangci.yml | 17 | - testifylint # Enforce testify best practices | CODE |
| MEDIUM | .github/workflows/artifacts-summary.lock.yml | 26 | # Generates a comprehensive summary of GitHub Actions artifacts usage across all workflows in the repository | COMMENT |
| MEDIUM | .github/workflows/github-mcp-tools-report.lock.yml | 26 | # Generates a comprehensive report of available MCP server tools and their capabilities for GitHub integration | COMMENT |
| MEDIUM | .github/workflows/example-permissions-warning.lock.yml | 26 | # Example workflow demonstrating proper permission provisioning and security best practices | COMMENT |
| MEDIUM | .github/workflows/pr-nitpick-reviewer.lock.yml | 26 | # ⚠️ DEPRECATED: Use PR Code Quality Reviewer (pr-code-quality-reviewer) instead. Provides detailed nitpicky code review | COMMENT |
| MEDIUM | .github/workflows/example-workflow-analyzer.lock.yml | 26 | # Analyzes workflow examples to identify patterns, best practices, and potential improvements | COMMENT |
| MEDIUM | .github/workflows/commit-changes-analyzer.lock.yml | 26 | # Analyzes and provides a comprehensive developer-focused report of all changes in the repository since a specified comm | COMMENT |
| MEDIUM | .github/workflows/scout.lock.yml | 26 | # Performs deep research investigations using web search to gather and synthesize comprehensive information on any topic | COMMENT |
| MEDIUM | .github/workflows/pr-code-quality-reviewer.lock.yml | 26 | # Comprehensive code quality review covering bugs, performance, style, naming, and best practices — consolidates Grumpy | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 994 | # Python is used for robust YAML-aware parsing instead of fragile AWK patterns. | COMMENT |
| MEDIUM | .github/workflows/cgo.yml | 1196 | # Full scan on main branch to ensure comprehensive coverage | COMMENT |
| MEDIUM | pkg/parser/schedule_parser_fuzz_test.go | 19 | // 6. UTC offset parsing is robust | COMMENT |
| MEDIUM | pkg/workflow/compiler_activation_job_test.go | 1059 | // TestInjectIfConditionAfterName verifies the robust line-oriented implementation of | COMMENT |
| MEDIUM | pkg/workflow/claude_logs.go | 373 | // This occurs with partial/malformed tool_use payloads and keeps parsing robust. | COMMENT |
| MEDIUM | pkg/workflow/mcp_renderer.go | 273 | // Resolve the node binary to its absolute path so the command is robust | COMMENT |
| MEDIUM | pkg/workflow/sanitize_output_fuzz_test.go | 20 | // via Node.js. This allows us to fuzz test JavaScript code using Go's robust | COMMENT |
| MEDIUM | pkg/workflow/mentions_fuzz_test.go | 19 | // via Node.js. This allows us to fuzz test JavaScript code using Go's robust | COMMENT |
| MEDIUM | pkg/workflow/evals_steps.go | 374 | // Use json.Marshal for robust string quoting (handles all JSON escape sequences) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eslint-factory/src/commonjs-syntax.test.ts | 14 | const messages = linter.verify(`function writeStepSummaryWithTokenUsage(coreObj) { await coreObj.summary.write(); }` | CODE |
| LOW | eslint-factory/src/commonjs-syntax.test.ts | 27 | const messages = linter.verify(`async function writeStepSummaryWithTokenUsage(coreObj) { await coreObj.summary.write | CODE |
| LOW | eslint-factory/src/rules/try-catch-rule-utils.ts | 18 | function getCommonContinuationIndent(lines: string[]): string { | CODE |
| LOW | eslint-factory/src/rules/require-fs-sync-try-catch.ts | 97 | function resolveFsSyncMethodFromIdentifier(node: TSESTree.CallExpression): string | null { | CODE |
| LOW | eslint-factory/src/rules/require-fs-sync-try-catch.ts | 146 | function getFsSyncMethodFromProperty(memberExpr: TSESTree.MemberExpression): string | null { | CODE |
| LOW | eslint-factory/src/rules/require-fs-sync-try-catch.ts | 161 | function isIdentifierBoundToFsModule(identifierName: string, scopeNode: TSESTree.Node): boolean { | CODE |
| LOW | eslint-factory/src/rules/no-json-stringify-error.ts | 96 | function isDefinitionAvailableAtNode(definition: { type: string; name?: TSESTree.Node | null; node: TSESTree.Node }, | CODE |
| LOW | eslint-factory/src/rules/no-json-stringify-error.ts | 105 | function hasResolvableLocalBinding(node: TSESTree.Node, name: string): boolean { | CODE |
| LOW | eslint-factory/src/rules/prefer-number-isnan.ts | 76 | function isProvablyNumericArgument(node: TSESTree.CallExpressionArgument): boolean { | CODE |
| LOW⚡ | …nt-factory/src/rules/require-async-entrypoint-catch.ts | 45 | function isFunctionDeclarationDefinition(definition: TSESLint.Scope.Definition): definition is FunctionDeclarationDefini | CODE |
| LOW⚡ | …nt-factory/src/rules/require-async-entrypoint-catch.ts | 53 | function isModuleScopeVariableDeclaration(node: TSESTree.VariableDeclaration): boolean { | CODE |
| LOW⚡ | …nt-factory/src/rules/require-async-entrypoint-catch.ts | 57 | function isAsyncVariableEntrypoint(definition: VariableDefinition): boolean { | CODE |
| LOW | …nt-factory/src/rules/require-async-entrypoint-catch.ts | 95 | function isAsyncModuleScopeEntrypoint(identifier: TSESTree.Identifier): boolean { | CODE |
| LOW | …ry/src/rules/no-unsafe-promise-catch-error-property.ts | 57 | function hasOrderedTruthinessGuard(conjuncts: TSESTree.Expression[], varName: string, prop?: string): boolean { | CODE |
| LOW | …ry/src/rules/no-unsafe-promise-catch-error-property.ts | 74 | function isTruthinessGuardedUnsafeAccess(node: TSESTree.MemberExpression, varName: string): boolean { | CODE |
| LOW | …ctory/src/rules/require-return-after-core-setfailed.ts | 70 | function isCallExpressionStatement(node: TSESTree.Statement): boolean { | CODE |
| LOW | …ctory/src/rules/require-return-after-core-setfailed.ts | 90 | function findContinuationOutsideBlock(setFailedNode: TSESTree.Statement, ancestors: TSESTree.Node[]): TSESTree.Statement | CODE |
| LOW | …ctory/src/rules/require-return-after-core-setfailed.ts | 204 | function isDestructuredSetFailedIdentifier(identifier: TSESTree.Identifier): boolean { | CODE |
| LOW | …ctory/src/rules/require-return-after-core-setfailed.ts | 303 | function getDirectControlBodyContainer(node: TSESTree.Statement): TSESTree.IfStatement | TSESTree.WhileStatement | T | CODE |
| LOW | …tory/src/rules/no-github-request-interpolated-route.ts | 14 | function isInterpolatedTemplateLiteral(node: TSESTree.Node): boolean { | CODE |
| LOW | …tory/src/rules/no-github-request-interpolated-route.ts | 71 | function isOpaqueWholeRouteInterpolation(node: TSESTree.Node): boolean { | CODE |
| LOW | …tory/src/rules/no-github-request-interpolated-route.ts | 94 | function isContextGithubExpression(node: TSESTree.Node): boolean { | CODE |
| LOW | …tory/src/rules/no-github-request-interpolated-route.ts | 108 | function isOctokitSourceExpression(node: TSESTree.Node): boolean { | CODE |
| LOW | …tory/src/rules/no-github-request-interpolated-route.ts | 166 | function isIdentifierBoundToOctokitClient(name: string, scopeNode: TSESTree.Node): boolean { | CODE |
| LOW | …nt-factory/src/rules/require-error-cause-in-rethrow.ts | 31 | function findTrackedIdentifierReference(node: TSESTree.Expression, trackedNames: ReadonlySet<string>, verifyIdentifier: | CODE |
| LOW | scratchpad/errors.md | 624 | async function createIssueWithValidation(github, config) { | CODE |
| LOW | docs/src/lib/workflow-hero/parseActionsYaml.ts | 15 | export function parseActionsWorkflowGraph(yamlText: string): WorkflowGraph { | CODE |
| LOW | docs/src/lib/workflow-visualizer/parseWorkflow.ts | 19 | function extractFrontmatterOrWholeDoc(input: string): string { | CODE |
| LOW | docs/src/pages/_aw-prompts.ts | 17 | function parseFrontmatterDescription(content: string): string { | CODE |
| LOW | scripts/generate-agent-factory.js | 67 | function extractEngineFromMarkdown(mdFilePath) { | CODE |
| LOW | scripts/generate-agent-factory.js | 103 | function extractScheduleFromMarkdown(mdFilePath) { | CODE |
| LOW | scripts/generate-agent-factory.js | 130 | function extractCommandFromMarkdown(mdFilePath) { | CODE |
| LOW | scripts/ensure-docs-slide-pdf.js | 58 | function createPlaceholderPdfBytes() { | CODE |
| LOW | .github/drivers/copilot_sdk_driver_sample_python.py | 25 | def extract_assistant_content(message: object) -> str: | CODE |
| LOW | .github/workflows/dependabot-burner.md | 188 | async function listRecentClosedBurnerPRs() { | CODE |
| LOW | .github/workflows/auto-close-parent-issues.yml | 34 | async function getIssueWithRelationships(issueNumber) { | CODE |
| LOW | .github/workflows/dependabot-burner.lock.yml | 568 | script: "const fs = require('fs');\nconst path = require('path');\n\nconst manifestTargets = new Set([\n '.gi | CODE |
| LOW | .github/workflows/shared/metrics-patterns.md | 221 | def calculate_workflow_metrics(workflow_runs): | CODE |
| LOW | .github/skills/temporary-id-safe-output/SKILL.md | 135 | function isValidIssueNumberOrTemporaryId(value) { | CODE |
| LOW | actions/setup/js/chroot_home_cleanup.test.js | 21 | function createFakeSudoEnvironment() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check-stale-lock-files.sh | 19 | # Usage: | COMMENT |
| LOW | scripts/delete-old-copilot-branches.sh | 12 | # Usage: | COMMENT |
| LOW | scripts/update-install-script-hashes.sh | 7 | # Usage: | COMMENT |
| LOW | scripts/bundle-wasm-docs.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/check-workflow-drift.sh | 10 | # Usage: | COMMENT |
| LOW | actions/setup/sh/resolve_docker_socket_gid.sh | 9 | # Usage: | COMMENT |
| LOW | pkg/constants/job_constants.go | 7 | // Example usage: | COMMENT |
| LOW | pkg/constants/job_constants.go | 27 | // Example usage: | COMMENT |
| LOW | pkg/constants/job_constants.go | 47 | // Example usage: | COMMENT |
| LOW | pkg/constants/constants.go | 30 | // Example usage: | COMMENT |
| LOW | pkg/constants/constants.go | 41 | // Example usage: | COMMENT |
| LOW | pkg/constants/constants.go | 61 | // Example usage: | COMMENT |
| LOW | pkg/constants/url_constants.go | 7 | // Example usage: | COMMENT |
| LOW | pkg/constants/url_constants.go | 17 | // Example usage: | COMMENT |
| LOW | pkg/constants/engine_constants.go | 9 | // Example usage: | COMMENT |
| LOW | pkg/constants/feature_constants.go | 7 | // Example usage: | COMMENT |
| LOW | pkg/constants/version_constants.go | 8 | // Example usage: | COMMENT |
| LOW | pkg/constants/version_constants.go | 28 | // Example usage: | COMMENT |
| LOW | pkg/workflow/config_helpers.go | 160 | // Example usage: | COMMENT |
| LOW | pkg/workflow/mcp_renderer.go | 35 | // Example usage: | COMMENT |
| LOW | pkg/workflow/update_entity_helpers.go | 387 | // Usage example: | COMMENT |
| LOW | pkg/workflow/mcp_environment.go | 42 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check-safe-outputs-conformance.sh | 1094 | except Exception as e: | CODE |
| LOW | .github/drivers/copilot_sdk_driver_sample_python.py | 119 | except Exception as error: | CODE |
| LOW | .github/workflows/daily-function-namer.md | 89 | except Exception: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 195 | except Exception as e: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 201 | except Exception as e: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 349 | except Exception as e: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 361 | except Exception as e: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 379 | except Exception as e: | CODE |
| LOW⚡ | .github/workflows/dataflow-pr-discussion-dataset.md | 388 | except Exception as e: | CODE |
| LOW | .github/workflows/dataflow-pr-discussion-dataset.md | 316 | except Exception as e: | CODE |
| LOW | .github/workflows/daily-security-observability.md | 301 | except Exception: | CODE |
| MEDIUM | …ub/skills/github-discussion-query/query-discussions.py | 35 | print(f"Error running gh command: {e.stderr}", file=sys.stderr) | CODE |
| MEDIUM | …ub/skills/github-discussion-query/query-discussions.py | 38 | print("Error: gh CLI not found. Please install GitHub CLI.", file=sys.stderr) | CODE |
| MEDIUM | …ub/skills/github-discussion-query/query-discussions.py | 54 | print(f"Error applying jq filter: {e.stderr}", file=sys.stderr) | CODE |
| MEDIUM | …ub/skills/github-discussion-query/query-discussions.py | 57 | print("Error: jq not found. Please install jq.", file=sys.stderr) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scratchpad/adding-new-engines.md | 586 | gh aw secrets set MY_ENGINE_API_KEY --value "<your-api-key>" | CODE |
| HIGH | docs/src/content/docs/reference/web-search.md | 38 | 2. Add as repository secret: `gh aw secrets set TAVILY_API_KEY --value "<your-api-key>"` | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ub/skills/github-discussion-query/query-discussions.py | 97 | {"description": "Get answered discussions", "query": ".[] | select(.answer != null)"}, | CODE |
| HIGH | …ub/skills/github-discussion-query/query-discussions.py | 98 | {"description": "Get unanswered discussions", "query": ".[] | select(.answer == null) | {number, title, cate | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .serena/project.yml | 30 | # same syntax as gitignore, so you can use * and ** | COMMENT |
| LOW | .serena/project.yml | 42 | # To make sure you have the latest list of tools, and to view their descriptions, | COMMENT |