feat: fix runtime-import in cross-repo workflow_call by detecting callee repository at checkout#20301
Draft
feat: fix runtime-import in cross-repo workflow_call by detecting callee repository at checkout#20301
Conversation
- Add hasWorkflowCallTrigger() helper to compiler_workflow_call.go - Add GenerateGitHubFolderCheckoutStep() to checkout_manager.go (uses checkout manager as recommended by @pelikhan) - Modify generateCheckoutGitHubFolderForActivation() to emit cross-repo- aware checkout with github.action_repository expression when workflow_call is detected - Add cross-repo guidance step in buildActivationJob() for actionable error messages when secret validation fails in workflow_call context - Add TestHasWorkflowCallTrigger tests and new compiler_activation_job_test.go - Update wasm golden files for new persist-credentials field ordering - Update glossary.md Trigger File entry with cross-repo information - Add Cross-Repository Trigger File section to central-repo-ops.mdx - Fix incorrect warning about secrets: inherit not working cross-repo Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add cross-repo workflow_call validation and documentation
feat: fix runtime-import in cross-repo workflow_call by detecting callee repository at checkout
Mar 10, 2026
Contributor
|
@copilot disable if inlined-imports is enabled. |
When inlined-imports: true, markdown is embedded at compile time and no runtime-import macros are used. The callee's .md files are not needed at runtime, so the workflow_call cross-repo checkout (github.action_repository) is not needed. Fall back to the standard checkout in that case. Also adds a test case for workflow_call + inlined-imports. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 3372558. When Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot review modified code and reuse checkout manager to generate checkout code |
…anager Converts the standalone package-level function to a method on *CheckoutManager, so the activation job uses the checkout manager abstraction to generate the .github/.agents sparse checkout step. The caller creates NewCheckoutManager(nil) to invoke the method. Test updated to use NewCheckoutManager(nil).GenerateGitHubFolderCheckoutStep(). Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 49acac2. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot add a agentic workflow that uses smoke-workflow-call agentic workflow. Runs on label "water" |
… label water - Add smoke-water.md workflow that triggers on PR label "water" and delegates to smoke-workflow-call.lock.yml via a jobs: uses: entry - Add SecretsInherit field to Job struct to support secrets: inherit for reusable workflow call jobs - Update compiler_jobs.go to parse secrets: inherit string value - Update JSON schema to allow secrets: inherit or map for jobs - Add TestBuildJobsWithReusableWorkflowSecretsInherit test Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in 539dc0c. Added Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot convert smoke-water agentic workflow into a simple action .yml file that does the trigger |
Replace smoke-water.md + smoke-water.lock.yml with a simple smoke-water.yml that directly calls smoke-workflow-call.lock.yml on PR label "water" or workflow_dispatch, matching the pattern used by smoke-trigger.yml. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in c54da2e. Replaced Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In
workflow_callcontext,github.repositoryis the caller's repo. The activation job'sactions/checkoutwas using that default, so the callee's.mdfiles were never on disk andprocessRuntimeImport()threwERR_SYSTEM: Runtime import file not found.Compiler changes
hasWorkflowCallTrigger(onSection string) bool(compiler_workflow_call.go) — standalone helper, mirrors the detection pattern already used ininjectWorkflowCallOutputs(*CheckoutManager).GenerateGitHubFolderCheckoutStep(repository string, getActionPin func) []string(checkout_manager.go) — method onCheckoutManagerthat centralizes.github/.agentssparse checkout generation; accepts an optionalrepositoryvalue that can be a literal slug or a GitHub Actions expressiongenerateCheckoutGitHubFolderForActivation(compiler_activation_job.go) — creates aNewCheckoutManager(nil)and calls the method; whenworkflow_callis inon:andinlined-importsis not enabled, injects a conditionalrepository:expression:Falls back to the caller's repo for every other event type, so mixed triggers (e.g.
workflow_call+workflow_dispatch) work correctly without a second checkout. Wheninlined-imports: trueis set, the cross-repo conditional is skipped because markdown content is embedded at compile time and no runtime-import macros are used — the callee's.mdfiles are not needed at runtime.Cross-repo guidance step (
buildActivationJob) — injected only whenworkflow_callis present; runs onfailure() && github.event_name == 'workflow_call'and emits::error::annotations directing the caller team to configureCOPILOT_GITHUB_TOKENin their repo.secrets: inheritsupport for reusable workflow call jobs (jobs.go,compiler_jobs.go, JSON schema) — addedSecretsInherit boolto theJobstruct, updated rendering to emitsecrets: inherit, updated the compiler to parse the"inherit"string value (previously only a map was handled), and extended the JSON schema to accept both.New workflow
smoke-water.yml— plain GitHub Actions trigger file (matching the pattern ofsmoke-trigger.yml) that triggers on PR labelwater(plusworkflow_dispatch) and callssmoke-workflow-call.lock.ymlwithsecrets: inheritand the required permissions.Tests
TestHasWorkflowCallTrigger— 6 cases covering mixed triggers, empty string, andworkflow_dispatch-onlyTestGenerateCheckoutGitHubFolderForActivation_WorkflowCall— verifies conditionalrepository:is present/absent based on trigger;action-tagskip behavior preserved;inlined-importscase falls back to standard checkoutTestGenerateGitHubFolderCheckoutStep— covers empty, literal, and expression repository valuesTestBuildJobsWithReusableWorkflowSecretsInherit— verifiessecrets: inheritis correctly emitted in compiled YAML for a reusable workflow call jobDocs
glossary.mdTrigger File entry expanded to mention cross-repo usage andsecrets: inheritbilling implicationscentral-repo-ops.mdx— new## Cross-Repository Trigger Filesection with example caller stub, visibility requirements, secrets config, and how the compiler handles checkout; corrected an existing incorrect warning that statedsecrets: inheritdoes not work across repos (it does)🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.