Add fork context hint to workflow failure conclusion messages by Copilot · Pull Request #18529 · github/gh-aw

Copilot · 2026-02-26T16:33:04Z

When a workflow fails in a forked repository due to missing secrets, the failure issue/comment provides no indication that fork secret isolation is the likely cause, making debugging unnecessarily hard for fork users.

Changes

handle_agent_failure.cjs: Added buildForkContextHint() that checks context.payload?.repository?.fork and returns an explanatory hint; injects fork_context into the template context for both new issue creation and existing issue comment paths
agent_failure_issue.md / agent_failure_comment.md: Added {fork_context} placeholder at the end of the error context block

Behavior

When repository.fork is truthy, the following is appended to failure bodies:

💡 This repository is a fork. If this failure is due to missing API keys or tokens, note that secrets from the parent repository are not inherited. Configure the required secrets directly in your fork's Settings → Secrets and variables → Actions.

Non-fork failure messages are unchanged — buildForkContextHint() returns an empty string when the repository is not a fork.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw nonexistent-workinit --limit node t-24�� k/gh-aw/gh-aw/.github/workflows/bot-detection.md go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha rt -buildtags /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu^remote\..*\.gh-resolved$ -uns�� -unreachable=false /tmp/go-build1764895835/b259/vet.cfg /usr/sbin/iptables -json GO111MODULE 64/bin/go iptables (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha vaScript509528824/001/test-front-s GO111MODULE Name,createdAt,startedAt,updated-buildmode=exe GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x-extld=gcc -uns�� runs/20260226-164303-28982/test-108936429/.github/workflows /tmp/go-build1764895835/b055/vet.cfg 4895835/b362/vet.cfg GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha echo "Syncing install-gh-aw.sh to actions/setup-go1.25.0 GOPROXY /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu-nolocalimports GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu/tmp/go-build1764895835/b420/_testmain.go -uns�� -unreachable=false /tmp/go-build1764895835/b034/vet.cfg 4895835/b358/vet.cfg g/timeutil/formagit g/timeutil/formarev-parse 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v4 --jq .object.sha -m Test commit /usr/bin/git ed-objects.md GO111MODULE nch,headSha,disp--show-toplevel git init�� GOMODCACHE x_amd64/vet /opt/hostedtoolcache/node/24.13.1/x64/bin/node -json GO111MODULE x_amd64/vet node (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -bool -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git k/gh-aw/gh-aw/scgit k/gh-aw/gh-aw/screv-parse 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha npx prettier --cGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go node /hom�� --check scripts/**/*.js 64/bin/go .prettierignore format:cjs 64/bin/go go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha INVALID,NEW -j DROP --write ../../../pkg/wor-atomic 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE node 64/bin/go tierignore ../../../pkg/wor-atomic 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet t-ha�� SameOutput1470748170/001/stability-test.md /tmp/go-build1764895835/b083/vet.cfg 4895835/b366/vet.cfg GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x-test.short=true GOINSECURE GOMOD GOMODCACHE /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -uns�� 4303-28982/test-881733664 /tmp/go-build1764895835/b078/vet.cfg .cfg GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env hub/workflows .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json .cfg 64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu-buildtags env -json .cfg 64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env ty-test.md .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env hub/workflows .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path "prettier" --cheGOSUMDB GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc/tmp/go-build1764895835/b209/vet.cfg -o /tmp/go-build1648737881/b360/_pkGOINSECURE -trimpath 64/bin/go -p github.com/githu-atomic -lang=go1.25 go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 github.com/stret-atomic -lang=go1.17 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet env ty-test.md .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env 3402621686/.github/workflows .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha .a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env ru7MKmH-P .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env -json .cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc/tmp/go-build1764895835/b215/vet.cfg -o /tmp/go-build1648737881/b354/_pkGOINSECURE -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc/tmp/go-build1764895835/b216/vet.cfg -V=f�� odules/npm/node_-json node 64/bin/go prettier --write 64/bin/go go (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build1764895835/b381/cli.test /tmp/go-build1764895835/b381/cli.test -test.testlogfile=/tmp/go-build1764895835/b381/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOSUMDB GOWORK 64/bin/go sh -c "prettier" --check 'scripts/**/*GOINSECURE node 64/bin/go tierignore ../../../pkg/wor-unsafeptr=false 64/bin/go go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name "prettier" --che-p GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc/tmp/go-build1764895835/b200/vet.cfg -V=f�� run-script/lib/n-c=4 sh 64/bin/go -d (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>[plan] Add fork context hint to workflow failure conclusion messages</issue_title>
<issue_description>## Context

Closes part of #18481 — gh-aw in forks.

When a gh-aw workflow fails in a fork due to missing secrets, the conclusion/failure job opens a GitHub issue or posts a comment with a generic error (e.g., "API key not found"). There is no mention of fork context as a likely cause, making debugging very hard for fork users.

Objective

Update the conclusion job's failure reporter to include a fork-context hint when github.event.repository.fork == true.

Approach

Locate where the conclusion job generates the failure issue body. This is likely in a .cjs file under actions/setup/js/ (e.g., conclusion.cjs or similar) or in the compiled workflow YAML directly.

Add a check: if context.payload.repository.fork === true (or the equivalent GitHub Actions expression ${{ github.event.repository.fork }}), append a fork hint to the failure message:

💡 This repository is a fork. If this failure is due to missing API keys or tokens, note that secrets from the parent repository are not inherited. Configure the required secrets directly in your fork's Settings → Secrets and variables → Actions.

The hint should appear in the body of any issue or comment opened by the conclusion job on failure.

Run make fmt-cjs && make lint-cjs to validate JS changes; run make recompile if workflow YAML was touched.

Files to Modify

Relevant .cjs file(s) under actions/setup/js/ that generate failure issue/comment bodies

Any associated test files

Acceptance Criteria

Fork hint is appended to failure issue/comment body when repository.fork === true

Hint clearly explains that secrets must be configured in the fork

Normal (non-fork) failure messages are unchanged

Linting passes
Related to Using gh-aw in forks of repositories #18481

Generated by Plan Command for issue #18481

expires on Feb 28, 2026, 4:18 PM UTC

Comments on the Issue (you are @copilot in this section)

Fixes [plan] Add fork context hint to workflow failure conclusion messages #18520

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

When a gh-aw workflow fails in a fork repository, append a hint to the failure issue/comment body explaining that secrets from the parent repository are not inherited. - Add buildForkContextHint() in handle_agent_failure.cjs that checks context.payload?.repository?.fork using optional chaining - Add fork_context to templateContext for both new issue creation and existing issue comment paths - Update agent_failure_issue.md and agent_failure_comment.md templates to include the {fork_context} placeholder Closes part of #18481 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Adds an explicit “fork context” hint to agent failure issues/comments so fork users can more easily diagnose failures caused by missing secrets (due to fork secret isolation).

Changes:

Added buildForkContextHint() in handle_agent_failure.cjs and injected fork_context into both the “new issue” and “existing issue comment” template contexts.
Appended {fork_context} to the agent failure issue/comment markdown templates.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/handle_agent_failure.cjs	Detects fork context via `context.payload.repository.fork` and passes a hint into template rendering paths.
actions/setup/md/agent_failure_issue.md	Adds `{fork_context}` placeholder to include the hint in created failure issues.
actions/setup/md/agent_failure_comment.md	Adds `{fork_context}` placeholder to include the hint in comments on existing failure issues.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-26T16:52:30Z

actions/setup/js/handle_agent_failure.cjs

+function buildForkContextHint() {
+  if (context.payload?.repository?.fork) {
+    return "\n💡 **This repository is a fork.** If this failure is due to missing API keys or tokens, note that secrets from the parent repository are not inherited. Configure the required secrets directly in your fork's Settings → Secrets and variables → Actions.\n";
+  }
+  return "";


New fork-context behavior is introduced here but handle_agent_failure.cjs currently has no unit tests. Given the repo’s extensive Vitest coverage for other action scripts, please add a focused test that asserts the rendered issue/comment body includes the fork hint when context.payload.repository.fork === true and remains unchanged (no hint) when false/undefined.

Initial plan

9278ae9

Copilot AI assigned Copilot and pelikhan Feb 26, 2026

Copilot started work on behalf of pelikhan February 26, 2026 16:33 View session

Copilot AI changed the title ~~[WIP] Add fork context hint to workflow failure messages~~ Add fork context hint to workflow failure conclusion messages Feb 26, 2026

Copilot finished work on behalf of pelikhan February 26, 2026 16:47

pelikhan marked this pull request as ready for review February 26, 2026 16:49

Copilot AI review requested due to automatic review settings February 26, 2026 16:49

pelikhan merged commit a32cb12 into main Feb 26, 2026
100 checks passed

pelikhan deleted the copilot/add-fork-context-hint branch February 26, 2026 16:49

Copilot started reviewing on behalf of pelikhan February 26, 2026 16:50 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add fork context hint to workflow failure conclusion messages#18529

Add fork context hint to workflow failure conclusion messages#18529
pelikhan merged 2 commits intomainfrom
copilot/add-fork-context-hint

Copilot AI commented Feb 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Behavior

I tried to connect to the following addresses, but was blocked by firewall rules:

Objective

Approach

Files to Modify

Acceptance Criteria

Comments on the Issue (you are @copilot in this section)

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 26, 2026 •

edited

Loading